Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25-04-2024 03:13
General
-
Target
Document.doc.scr.exe
-
Size
194KB
-
MD5
50e5dec57451005668704281688ca55d
-
SHA1
67dd4ac7eb8c193b39149b34d3a0d5bc21c3f200
-
SHA256
062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1
-
SHA512
29ca4a44795c71d3e2b4e3417355ebb93765157d464d6d5a3fe6774056d934d57081c72001fb29e47982da11e5a5ccfdbcc958d05a11fb49bd8bf84e6d0c61ad
-
SSDEEP
3072:66glyuxE4GsUPnliByocWepRGbVZqid91h2ys+tU:66gDBGpvEByocWeubV4inP9B
Malware Config
Signatures
-
Renames multiple (287) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.doc.scr.exe"C:\Users\Admin\AppData\Local\Temp\Document.doc.scr.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\9B84.tmp"C:\ProgramData\9B84.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9B84.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5c554781ca8ad34b9a215872e8d2e7b2b
SHA19f8a85b93db7f37352a2c0b00a8db561e9fcf4ea
SHA25627714734fb4999086c40a7284e48ff4c498ad03c2d00622500b519548be50dfb
SHA512e13b38c3490242a83a6b7dc6330032b17cc75258a09777843549211731da5180b5e6756a9e04814d0b62bd275cd18e1ba78c6c3855e66b22242d9243c3114a33
-
Filesize
434B
MD5ad29bd8c66e114ff57c943d16c78f72a
SHA15ab070ee89a36f38facae4dfc8ec5ce3e59af46e
SHA2566fe668fe8bf69158d1fd08e90f3cff60c1df410bf752635bf152853b6112549c
SHA512a53121e2379aa9c3bc52d073498a54f26383834f6d6636b4b3831010565c80bf0da07511907eab7bd92f9796e559958b1c0ebea4c4b0f0d869e95b7deb5da7f1
-
Filesize
194KB
MD54952591960de6aca594760fc9b4bcb14
SHA1f1f1ad5a317e62f0db9bf92df59f9ec728dbe29d
SHA256994c069ee2512420bd7c99130917fad95e849e94a6cbcb73bb118a7993de8e35
SHA512fd41371386f12dd1ea0ff3c27955b68387abcffd970c3141be8e2f3a398ca8720f65cfb0ed23c6c99169a53c65a1aa14858d3c0b5b511c329e18bdc6fbdaebc7
-
Filesize
129B
MD503faeb00a3a9ff1b3e3bf7a1d530765f
SHA168a85be926b7da0969ac679000ff86cb8f622128
SHA256e41a8015250c9868b5e56da83b5ff04d60a12cdfd9beb2bc2b47e2a1b35c127f
SHA512ccbefadae57594c54e2c46f00a3266f5465d2066dbe8cd30d28cb82dbe18634810ae82a0f4582e001432ba8e5d681314c1d542be3ea4aab6196ab11baae27863
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB