Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
25-04-2024 14:22
General
-
Target
Document.doc.scr
-
Size
194KB
-
MD5
b7b4c97132d03eead1fa9a9352dee6c2
-
SHA1
c9eb1bdc528076fa9c91668addf0723294ac1575
-
SHA256
1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2
-
SHA512
cb0023bc6783a94a27d2d4a67c214e8657fd334d1a94a7dba51277363dee2a67e7ecc5fc0788cead1c4e0e2dc7d9aa758203f89dce162184869d20a44d171903
-
SSDEEP
3072:v6glyuxE4GsUPnliByocWepXKD0/9Wy1Og/ZK99r:v6gDBGpvEByocWehKD0/EWfg3
Malware Config
Signatures
-
Renames multiple (596) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.doc.scr"C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
C:\ProgramData\6A15.tmp"C:\ProgramData\6A15.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6A15.tmp >> NUL3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D696E4AF-3453-423C-94F4-B07ECC04E087}.xps" 1335852858591700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2177723727-746291240-1644359950-1000\GGGGGGGGGGGFilesize
129B
MD5a6c339859ad12e8de9fca7f9e65c7ee2
SHA146ef1b686b7feec20b93541cadc9ffbdf4119d98
SHA256d5dcf802a598fa929c4d41e02ca1fb8c3c435ccd85d24aa16cd27a1f882005e1
SHA512ab92181df34d0be11adc6837f9b9a2671988131169294f3c85ea43024276426a39b8e8aafc77da098612570141f16f31e56dc1ece18ce1b691fe8ea2b06122ab
-
C:\ProgramData\6A15.tmpFilesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDFilesize
194KB
MD53ab1f21c7ca3080097fcc77df7c5ccb5
SHA1960c6ba6ddd70d9aec3de4452f179c16407ebfc4
SHA2564848094b15c8b3d148797d06668dde31241c9ea8a0bfe9e4cd30de932c184515
SHA512e8c3278e05319dc7168561882532cc29be8ed7e268571e73fa82599b1bfb87ebe3d8a7269cf6ac2b64f317a6dfdf8a106ee2f4ae2bfcdba0f3b327b6be40e8c9
-
C:\Users\Admin\AppData\Local\Temp\{6C9E71AB-D283-47F7-8592-3046161164CC}Filesize
4KB
MD56dbc5a9d8a4aab4e143f24806cc6e0e0
SHA16f3eca0f6b181d849e055952facd2450744ceb91
SHA256a7578794d1ba3cba18537f9b8c67c5b1e6575e631b33902b87d275607af192a8
SHA512cea11dea79acf9b9b33619c046e070df1e96899a7315a8960370015e5e21dbd52eca91ce8fbbb04075632f02ab9225826469547cd23550191eaf6499251e91d6
-
C:\te8ZzuVLn.README.txtFilesize
434B
MD5ad29bd8c66e114ff57c943d16c78f72a
SHA15ab070ee89a36f38facae4dfc8ec5ce3e59af46e
SHA2566fe668fe8bf69158d1fd08e90f3cff60c1df410bf752635bf152853b6112549c
SHA512a53121e2379aa9c3bc52d073498a54f26383834f6d6636b4b3831010565c80bf0da07511907eab7bd92f9796e559958b1c0ebea4c4b0f0d869e95b7deb5da7f1
-
F:\$RECYCLE.BIN\S-1-5-21-2177723727-746291240-1644359950-1000\DDDDDDDDDDDFilesize
129B
MD55d82856cc87b826465187d5b7a72a421
SHA17cfce8b8cbc71298b69a8e11067c45fdba5e9d70
SHA2566fbc70cecedc6ba6d6966f41170694b78fbe9d0939a53831682ecd4d8f6e93ed
SHA512ad4d3cecde35f847c73ce8aa0c7b79ad2887be70c575f96435b650e2f361bc94114e3630234dba388c70987bd8bae0802879d3b379a2204f1884a0d9c9af56c1
-
memory/1604-1-0x0000000002BA0000-0x0000000002BB0000-memory.dmpFilesize
64KB
-
memory/1604-0-0x0000000002BA0000-0x0000000002BB0000-memory.dmpFilesize
64KB
-
memory/3204-2782-0x00007FFF1E130000-0x00007FFF1E140000-memory.dmpFilesize
64KB
-
memory/3204-2787-0x00007FFF5E0B0000-0x00007FFF5E2A5000-memory.dmpFilesize
2.0MB
-
memory/3204-2750-0x00007FFF1E130000-0x00007FFF1E140000-memory.dmpFilesize
64KB
-
memory/3204-2781-0x00007FFF5E0B0000-0x00007FFF5E2A5000-memory.dmpFilesize
2.0MB
-
memory/3204-2783-0x00007FFF5E0B0000-0x00007FFF5E2A5000-memory.dmpFilesize
2.0MB
-
memory/3204-2784-0x00007FFF1E130000-0x00007FFF1E140000-memory.dmpFilesize
64KB
-
memory/3204-2786-0x00007FFF5E0B0000-0x00007FFF5E2A5000-memory.dmpFilesize
2.0MB
-
memory/3204-2785-0x00007FFF5E0B0000-0x00007FFF5E2A5000-memory.dmpFilesize
2.0MB
-
memory/3204-2747-0x00007FFF5E0B0000-0x00007FFF5E2A5000-memory.dmpFilesize
2.0MB
-
memory/3204-2752-0x00007FFF5E0B0000-0x00007FFF5E2A5000-memory.dmpFilesize
2.0MB
-
memory/3204-2743-0x00007FFF1E130000-0x00007FFF1E140000-memory.dmpFilesize
64KB
-
memory/3204-2822-0x00007FFF5E0B0000-0x00007FFF5E2A5000-memory.dmpFilesize
2.0MB
-
memory/3204-2820-0x00007FFF5E0B0000-0x00007FFF5E2A5000-memory.dmpFilesize
2.0MB
-
memory/3204-2751-0x00007FFF1E130000-0x00007FFF1E140000-memory.dmpFilesize
64KB
-
memory/3204-2746-0x00007FFF5E0B0000-0x00007FFF5E2A5000-memory.dmpFilesize
2.0MB
-
memory/3204-2792-0x00007FFF1B7D0000-0x00007FFF1B7E0000-memory.dmpFilesize
64KB
-
memory/3204-2796-0x00007FFF5E0B0000-0x00007FFF5E2A5000-memory.dmpFilesize
2.0MB
-
memory/3204-2795-0x00007FFF1B7D0000-0x00007FFF1B7E0000-memory.dmpFilesize
64KB
-
memory/3936-2794-0x000000007FE00000-0x000000007FE01000-memory.dmpFilesize
4KB
-
memory/3936-2793-0x000000007FDE0000-0x000000007FDE1000-memory.dmpFilesize
4KB
-
memory/3936-2791-0x000000007FDC0000-0x000000007FDC1000-memory.dmpFilesize
4KB
-
memory/3936-2790-0x000000007FE20000-0x000000007FE21000-memory.dmpFilesize
4KB
-
memory/3936-2789-0x00000000022F0000-0x0000000002300000-memory.dmpFilesize
64KB
-
memory/3936-2821-0x000000007FE00000-0x000000007FE01000-memory.dmpFilesize
4KB
-
memory/3936-2788-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB