43c59cd33371691282d4f781b6f5d0b280da41d71fceeecc7b7052a1db11ac79

Analysis

max time kernel
92s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2024, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4_Запит.docx.exe
Size 1.1MB
Sample240215-net25sfb2y
SHA256 43c59cd33371691282d4f781b6f5d0b280da41d71fceeecc7b7052a1db11ac79
MD5 2977265d2d17a378f16795570ef6958f
SHA1 2e3decf35bd6fee40430df53e84044ace1826201
SHA512 19b438afc06297e9ea9276894bba0608da5f961597740bcbc5c626b4c166393dd174b1325f1f96088f4c05a27094e9364cba5df37ba95c017cfe2d6590ea49cb
SSDEEP 24576:zYhWZ91p34SGFDKJ44NVL13GF5xTn61YO/unvXeXv7ocRiPbH/gO+x:0he91p3R+KJ4aJ13Glz6mEuvXsv72jIB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	4_Запит.docx.exe

Executes dropped EXE 1 IoCs

pid	Process
2808	Mrna.pif

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
232	tasklist.exe
3608	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3744	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2808	Mrna.pif
2808	Mrna.pif
2808	Mrna.pif
2808	Mrna.pif
2808	Mrna.pif
2808	Mrna.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	232	tasklist.exe
Token: SeDebugPrivilege	3608	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2808	Mrna.pif
2808	Mrna.pif
2808	Mrna.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2808	Mrna.pif
2808	Mrna.pif
2808	Mrna.pif

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2176	2268	4_Запит.docx.exe	86
PID 2268 wrote to memory of 2176	2268	4_Запит.docx.exe	86
PID 2268 wrote to memory of 2176	2268	4_Запит.docx.exe	86
PID 2176 wrote to memory of 232	2176	cmd.exe	88
PID 2176 wrote to memory of 232	2176	cmd.exe	88
PID 2176 wrote to memory of 232	2176	cmd.exe	88
PID 2176 wrote to memory of 3168	2176	cmd.exe	89
PID 2176 wrote to memory of 3168	2176	cmd.exe	89
PID 2176 wrote to memory of 3168	2176	cmd.exe	89
PID 2176 wrote to memory of 3608	2176	cmd.exe	91
PID 2176 wrote to memory of 3608	2176	cmd.exe	91
PID 2176 wrote to memory of 3608	2176	cmd.exe	91
PID 2176 wrote to memory of 1696	2176	cmd.exe	92
PID 2176 wrote to memory of 1696	2176	cmd.exe	92
PID 2176 wrote to memory of 1696	2176	cmd.exe	92
PID 2176 wrote to memory of 5104	2176	cmd.exe	93
PID 2176 wrote to memory of 5104	2176	cmd.exe	93
PID 2176 wrote to memory of 5104	2176	cmd.exe	93
PID 2176 wrote to memory of 4068	2176	cmd.exe	94
PID 2176 wrote to memory of 4068	2176	cmd.exe	94
PID 2176 wrote to memory of 4068	2176	cmd.exe	94
PID 2176 wrote to memory of 2656	2176	cmd.exe	95
PID 2176 wrote to memory of 2656	2176	cmd.exe	95
PID 2176 wrote to memory of 2656	2176	cmd.exe	95
PID 2176 wrote to memory of 2808	2176	cmd.exe	96
PID 2176 wrote to memory of 2808	2176	cmd.exe	96
PID 2176 wrote to memory of 2808	2176	cmd.exe	96
PID 2176 wrote to memory of 3744	2176	cmd.exe	97
PID 2176 wrote to memory of 3744	2176	cmd.exe	97
PID 2176 wrote to memory of 3744	2176	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\4_Запит.docx.exe
"C:\Users\Admin\AppData\Local\Temp\4_Запит.docx.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k move Ranked Ranked.bat & Ranked.bat & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:232
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3608
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa.exe opssvc.exe"
    3⤵
    PID:1696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 23771
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Miracle + Incomplete + Handbags + Pound + Remind + Previously 23771\Mrna.pif
    3⤵
    PID:4068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b Holocaust + Tonight + Narrative 23771\u
    3⤵
    PID:2656
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\23771\Mrna.pif
    23771\Mrna.pif 23771\u
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2808
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Mrna.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\23771\Mrna.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\23771\u
Size 1014KB
SHA256 5bc0d30076f3e85629a02ce7228505f90225819a13f10a9e3ad0fe6586cc520b
MD5 2f9465e9a86a85a62358c1fa1d405212
SHA1 2a3db37de55f686daa8665d9399e626a7784cf73
SHA512 68f227abb149c15ab8cfbf2f4a82ff8dc2d60ba4a5c28957af88e02d5ec3dde053cb3304231be29fe39234600a0c7e2aa8388b26a999f0f5cc2ac8db09e8c7b0
SSDEEP 12288:Rh39TEb7ITbo1+Vw+SVAVKaiMY8imOMXlskovz6VohPkHIpCjVXtsW9m/1orBX0s:a89lskovz60kHIgIW9SarGif/qc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Handbags

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Handbags
Size 140KB
SHA256 c47614dbfdbd69982baaae340d990e98786c0b37ceb3a286178e9600085a9821
MD5 05e578e1eb1371e47f5d7fcbbcf04802
SHA1 a2638559cc26f4bd0744ec0df225aef7f2568833
SHA512 1d9d7a403ef8fecfcb708e8aa2db5fd80a15278bf3dbed207b7e2cdbbd117f15f310aaf22711a73c5778a7ed05d87ed9a9f55c2fc91132988a2bba0e07676348
SSDEEP 3072:+wHJJX4xF5jtHk5B+LNBPcAvPTjFq9iOIXyTw0ltj0EowPOGU6WS2uLhxjRYl:+qJX4xNAB+xHFq9O0lHPOGUWLhxjRYl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Holocaust

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Holocaust
Size 423KB
SHA256 e729936601aaeb2bbbe98295f1f6534fcda3720b9b6be62cb45ce63531ef1ee4
MD5 5b92d0a804b02ab65c32a5521fd5f7cc
SHA1 c8448700466353c45e2ccd5011697a4f1622adc2
SHA512 3edce8674d7b0b4673284743186bcb693cbe601412fe26915aa11a43276021038e388d9790fcffaed56465a1bd29224de41af2203f53f1bb7c18fb9f01d4df79
SSDEEP 12288:Rh39TEb7ITbo1+Vw+SVAVKaiMY8imOMXlskovz6VohPkHII:a89lskovz60kHII
MD5 SHA1 SHA512 SSDEEP

Submit Download

Incomplete

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Incomplete
Size 170KB
SHA256 a3d6040a9281d0ea604d8b3e47ea24e89504db4e3a7f800d11e75155c81a48f7
MD5 4d705268328df61d2ee2b4f7fe7cf3cc
SHA1 bb18150b2741c605c6af0f1423b4f8ea678d130b
SHA512 e3068c715c906877d40671f481072758356f152d8e66ad80386c91baf407dc564eea167582246f2a9e042ab0ac4505f4e1181241ab87fb0187bdc661b6e71f99
SSDEEP 3072:WwzW3Nzl8F5hPLaLWysRIO7vHZnBfzHl8Dz5YaZYvlfA6Gfza6iyY5tVGvH7fsUV:JzwNzlmhPL1b5nZ2tZ6lfA6Gfm608Ds6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Miracle

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Miracle
Size 292KB
SHA256 9c592b9868e4103c8f5b028bc8614316de2762908f5f273fe752c3f7581c0325
MD5 88bd82f33fcba6fade187873bd6e10f8
SHA1 5e32ef0fe34c307856ff9b5cdfa73a7ab503227d
SHA512 d06788c9d457e652e5ebab0daa53f1cbeddd077740dc671b876820eff86f0db68fad6811b33496717706d9b8d7e31589930b39a13399b2fcd378ccc966129f05
SSDEEP 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4mqd12lqlEAehuqNw:LO0z8e0lvSr0Wyw20K4mqClqlEZuT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Narrative

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Narrative
Size 94KB
SHA256 8e7cd712673328257f966257938fcb6294810989d6b105678d7fb9ed40f2c850
MD5 d0ff747940baa3af7be8324a6f467e15
SHA1 0473a9eed45b3731bd58985c4687ace2acd3c9b5
SHA512 4f12e13351d81ec6371f670785f9ee73d9817b24e47c5f025fcd3725597fd1fdd25582d8ddde45d78e6e80d30eda1a53c71f386bd7b0dd461e56a5fdb5e78a99
SSDEEP 1536:SrZDN7gQHkmAQa9xyPta7imqRxoRxUCelPaMDjEy8MIKEG3:2DN7gQHwQa/yVa7ylPaMDjEy8MNEG3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pound

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pound
Size 134KB
SHA256 d86307ed56de3f707f16363602ca04eadeb7ffc0154da284b61f3554835c38ef
MD5 3b46fbb056397cbe82dcaffaec73e8fe
SHA1 fe132ab41fe0c80407f34cebf53f9baf49968bc8
SHA512 f2a2f120933381d585757c76e69ebb777b5e804d83430f6e500963f4d6b753bb26d245754623c0028ea4464c09965ef3d83b791dc9e16a7e0e39fbf194e41fd6
SSDEEP 3072:x/fA9vtqmcCVs5A3q5eAg0Fuz08XvBNbIaAtbP8:AFqZvEAOz04pmdVE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Previously

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Previously
Size 72KB
SHA256 ecca65ac40d62422699bdcd1af94132f7ce1e78b150acfc1a2be4fe6682607a4
MD5 e95655f90468a2207ced54d4abef53c1
SHA1 b7807db53e1dbe75117b4292733440e7259b6ca0
SHA512 603560a305b3f92c608fd70dae5ec98d2d068877f9565ab5648f4c7bc52bc2587884810d2843cbcabd4a69436e9c1720d79ed12660f81304b3bb3aa854954f6f
SSDEEP 1536:TWyu0uZo2+9BkxXiblenlJJyIE2UWb/hoQZ2OE3:TWy4ZNogXJ3i2Umb2Oq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ranked

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ranked
Size 11KB
SHA256 c88f34ad991dbae179b452affc344273d51f20d4ca8a8d50283b55b7b32a857b
MD5 3250f73998cdfc72afc147cafdfe6c17
SHA1 da720cb43ae9242cc64dda30750a488686106394
SHA512 c582c45e3a9f376a18d449cdddb1cc5774c0f98408a61cedb3356fe2d02fe11ed3649eb3596cb62a56c8dd047c796b23b5e31a1e97e1c0fcdb669661650b3954
SSDEEP 192:+aWxWLc4LjBkx8bygil6V4eGs5Gs7c07uNIrqv:+bqFOoyHAVFGs5Gs7c07uNIrU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Remind

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Remind
Size 116KB
SHA256 80486c6639d60e936959485095ac5b351736bc8405a7a54d57b8f90afcf10811
MD5 4ed28450aceba74feded40ec34dd6534
SHA1 09c89497f6a42a544993d3d3f9dd8cbb3141cccc
SHA512 0f4919d5ef731572bbcd587417f51b9ac857a731f0dcbaab02f8833f8940196397956ac2a05b23021950d842058db409f3db5422d5ae96c0e80b59f2770381d9
SSDEEP 1536:QMaj6iTcohiPfKj+wsxjgarB3RZg3EYrX:s6jKj+wsxjgarB3RZgX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tonight

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Tonight
Size 497KB
SHA256 268ce2c3f918f58774a37d80d86728d0e3338831670e5034146df7209b34ee97
MD5 ca5c9e4165fb7caa334fb6d097e5fa15
SHA1 46eeed7555d7524358b9747b0d0ef3074a89d487
SHA512 4e1a57350698429e701a92da043685ab6dad929f6f927569dff56ecc0428a88b9899f83f8bb1697fb9f6d1b68a2481a41ef096bf4a56a4309d62c501222476b8
SSDEEP 6144:QBCzeeoUZu4tYFC+k9mvn1OvrBcQ2uI/PLYoCGwpa8mt7f8O:QCjVXtsW9m/1orBX0/DYvzckO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2808-35-0x00000000778A1000-0x00000000779C1000-memory.dmp

Download

memory/2808-37-0x0000000004030000-0x0000000004031000-memory.dmp

Download

memory/2808-38-0x0000000004FD0000-0x000000000504A000-memory.dmp

Download

memory/2808-39-0x0000000004FD0000-0x000000000504A000-memory.dmp

Download

memory/2808-40-0x0000000004FD0000-0x000000000504A000-memory.dmp

Download

memory/2808-41-0x0000000004FD0000-0x000000000504A000-memory.dmp

Download

memory/2808-42-0x0000000004FD0000-0x000000000504A000-memory.dmp

Download

memory/2808-43-0x0000000004FD0000-0x000000000504A000-memory.dmp

Download

memory/2808-44-0x0000000004040000-0x0000000004041000-memory.dmp

Download

memory/2808-45-0x0000000004040000-0x0000000004041000-memory.dmp

Download

memory/2808-46-0x0000000004040000-0x0000000004041000-memory.dmp

Download

memory/2808-47-0x0000000004FD0000-0x000000000504A000-memory.dmp

Download