bbc1b383118409c054202e2995b749a4b85e224e78782bedbbd81b94845dc094

General

Target

57698b721d5852a5b7fef0f428d20dbf.exe
Size

52KB
MD5

57698b721d5852a5b7fef0f428d20dbf
SHA1

31d16e5c2c327ba4f0a2336427ab70d465535ba7
SHA256

bbc1b383118409c054202e2995b749a4b85e224e78782bedbbd81b94845dc094
SHA512

634c7fda1d6483c46ed9e257484aa9a6c24ef1e39a0689267f91b407b9a842ee595718f7ab181a86f4a494f4d15149bba84174ac11383649e71d8d6fe6080084
SSDEEP

768:QGxG8ftqr1zfinbAyUD1IyobuV2YlyW4Xw9cxK9uN3UADLzPUwQreLQZ:Qcrftqr1zqpURIy9CWPcxx/vz87eLQZ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	57698b721d5852a5b7fef0f428d20dbf.exe

Deletes itself 1 IoCs

pid	Process
2528	abs.exe

Executes dropped EXE 3 IoCs

pid	Process
3692	kernel32.exe
2528	abs.exe
4116	kernel32.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kernel32.exe	kernel32.exe
File created	C:\Windows\SysWOW64\kernel32.asf	kernel32.exe
File created	C:\Windows\SysWOW64\00628.dat	kernel32.exe
File created	C:\Windows\SysWOW64\kernel32.exe	kernel32.exe
File opened for modification	C:\Windows\SysWOW64\kernel32.exe	kernel32.exe
File created	C:\Windows\SysWOW64\kernel32.dfg	kernel32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	57698b721d5852a5b7fef0f428d20dbf.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3040	WINWORD.EXE
3040	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4116	kernel32.exe
4116	kernel32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	kernel32.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1212	57698b721d5852a5b7fef0f428d20dbf.exe
2528	abs.exe
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE
3040	WINWORD.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 3692	1212	57698b721d5852a5b7fef0f428d20dbf.exe	89
PID 1212 wrote to memory of 3692	1212	57698b721d5852a5b7fef0f428d20dbf.exe	89
PID 1212 wrote to memory of 3692	1212	57698b721d5852a5b7fef0f428d20dbf.exe	89
PID 1212 wrote to memory of 3040	1212	57698b721d5852a5b7fef0f428d20dbf.exe	90
PID 1212 wrote to memory of 3040	1212	57698b721d5852a5b7fef0f428d20dbf.exe	90
PID 1212 wrote to memory of 2528	1212	57698b721d5852a5b7fef0f428d20dbf.exe	91
PID 1212 wrote to memory of 2528	1212	57698b721d5852a5b7fef0f428d20dbf.exe	91
PID 1212 wrote to memory of 2528	1212	57698b721d5852a5b7fef0f428d20dbf.exe	91
PID 4116 wrote to memory of 628	4116	kernel32.exe	4

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:628

C:\Users\Admin\AppData\Local\Temp\57698b721d5852a5b7fef0f428d20dbf.exe
"C:\Users\Admin\AppData\Local\Temp\57698b721d5852a5b7fef0f428d20dbf.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\kernel32.exe
  "C:\Users\Admin\AppData\Local\Temp\kernel32.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:3692
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\57698b721d5852a5b7fef0f428d20dbf.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\abs.exe
  "C:\Users\Admin\AppData\Local\Temp\abs.exe" C:\Users\Admin\AppData\Local\Temp\57698b721d5852a5b7fef0f428d20dbf.exe C:\Users\Admin\AppData\Local\Temp\57698b721d5852a5b7fef0f428d20dbf.doc
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2528

C:\Windows\SysWOW64\kernel32.exe
C:\Windows\SysWOW64\kernel32.exe -k netsvcs
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\57698b721d5852a5b7fef0f428d20dbf.doc

Filesize
21KB

MD5
ca7c25d8ede0ef67dbbbd0a52d02c50f

SHA1
c8428f311b0331b8a8f9bc656eb042cd499835cf

SHA256
65b51f79e7a9be4077b27c3fc1c54897ab1424a6f9ac8aac31fd398b786a912d

SHA512
f7cb4c5210d531c056171e397d780276b0223c7858d39b79f13513395afe86a974587789db13f172dbf926ab0ed5263387e96d3ae727e7653a0f3a0758fe8b96

Download Submit
C:\Users\Admin\AppData\Local\Temp\abs.exe

Filesize
52KB

MD5
57698b721d5852a5b7fef0f428d20dbf

SHA1
31d16e5c2c327ba4f0a2336427ab70d465535ba7

SHA256
bbc1b383118409c054202e2995b749a4b85e224e78782bedbbd81b94845dc094

SHA512
634c7fda1d6483c46ed9e257484aa9a6c24ef1e39a0689267f91b407b9a842ee595718f7ab181a86f4a494f4d15149bba84174ac11383649e71d8d6fe6080084

Download Submit
C:\Users\Admin\AppData\Local\Temp\kernel32.exe

Filesize
14KB

MD5
e2f42a86d702af3b5c94b5bdaacb3625

SHA1
670c18c79380a8270dfbdb5cce5b60dbd56774de

SHA256
cf08bd8070f865943bfcb55b21cbe79d26706427112e6dccfbd01a03457c0d8d

SHA512
770074c537015a5fc3ab3e38a2c96604dde105dfce08fae0487d5eb64083035d6b3c6c0c5ad4e3c7f3eda882a48dbbac40aca00b5bdd5f3e0a06801c7b1f7179

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Windows\SysWOW64\kernel32.dfg

Filesize
46B

MD5
180d4525a54f6e370785134421bfc6c5

SHA1
e183da9ec06f5a4eddb5988437a9c0a0746ce4fa

SHA256
35f559607a554f4b62529ca15116933b956a9d8f320cc1b44ad39b9f0f856930

SHA512
61353a378188b7aee89cfefabd33b21e5f54bfc78c07f177ec0fa0dde75feab44895ed8c4e1290139e41bc396950c499795dc70526a9aea2ed3f86be3bc42455

Download Submit
memory/1212-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1212-31-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2528-43-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2528-40-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3040-33-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-19-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

Filesize
64KB

Download
memory/3040-32-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

Filesize
64KB

Download
memory/3040-35-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-36-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-24-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

Filesize
64KB

Download
memory/3040-21-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-37-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-38-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-39-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-30-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-41-0x00007FF9AFCB0000-0x00007FF9AFCC0000-memory.dmp

Filesize
64KB

Download
memory/3040-20-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

Filesize
64KB

Download
memory/3040-44-0x00007FF9AFCB0000-0x00007FF9AFCC0000-memory.dmp

Filesize
64KB

Download
memory/3040-102-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-34-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

Filesize
64KB

Download
memory/3040-103-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-99-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

Filesize
64KB

Download
memory/3040-101-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-75-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-76-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-77-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-78-0x00007FF9F22D0000-0x00007FF9F24C5000-memory.dmp

Filesize
2.0MB

Download
memory/3040-97-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

Filesize
64KB

Download
memory/3040-98-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

Filesize
64KB

Download
memory/3040-100-0x00007FF9B2350000-0x00007FF9B2360000-memory.dmp

Filesize
64KB

Download
memory/3692-11-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3692-68-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4116-74-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4116-51-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads