Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25-04-2024 16:37
General
-
Target
Document.doc.scr
-
Size
194KB
-
MD5
ae811bd6440b425e6777f0ca001a9743
-
SHA1
70902540ead269971e149eaff568fb17d04156af
-
SHA256
86e17aa882c690ede284f3e445439dfe589d8f36e31cbc09d102305499d5c498
-
SHA512
3617d8e77c221525125778cf64f2525136f7958766f5bed0fd7bfe00e7f738017d2840972acc628e4c3471b93cf6d52ccd619f49bdbbcff824c12cac8e1ea88e
-
SSDEEP
3072:a6glyuxE4GsUPnliByocWepiHkZmlkQIQP6fo:a6gDBGpvEByocWeQwLAPm
Malware Config
Signatures
-
Renames multiple (323) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.doc.scr"C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\30C1.tmp"C:\ProgramData\30C1.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\30C1.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a582d39133c2ea5a063a913ff86555a2
SHA16e99ccd06059f1599cae5259a03bbe8cd920685c
SHA256172e7e70c132188a570246a3b28c9e8a125b908f28f90dc2f833f20c855df101
SHA51285e926fe5c8f089cc841ab1358093a8d6001885280ece7bd2a1a07ac1bd890576d135fc05e8c0167cc712624937c45720be579dba7c2728fa462922631cca8b6
-
Filesize
194KB
MD5a8e909aae5355697bac3013b7cfb8cc0
SHA10a8c79698560c1503191f1bf9770536a9c1a5bfb
SHA256354570b1d8372350a7ac3baafd747122185f28504494e3528f23c279ba1550ff
SHA51230f9029384d8631b6a1b473c13dee1a5ddca502fc39726def54cda6678ac2cb3502380d6993ea9adf37979b20363ab32a097d7355f019bcd43b4a30cca5e97ec
-
Filesize
449B
MD5c2f46db865b0ba6ef8f9385cf458a56e
SHA10b2f94fcf38ef15f59bb86a3296b7da514b4ac4e
SHA256c25759e6083dd4bf592a6da2063c45def5adc9a6ef2ed15820128a0d838f70fe
SHA5129927b209ca26e3243fac9f003c6af7663ba84405346fbdb66c6f401387cd20ea3f99d63d0858ebdc76f2e6bc722d41e2a1f599bc6f7d97b0687dba95dea31b39
-
Filesize
129B
MD5ccda22548e193fccbf6b30822f808383
SHA1c2692f741d93533503dd7cc2dfe0e4cdcc4bce15
SHA2566e6b5e905491dd21b7af2c30789426126770e2c0ce77b8bd848a0521e1de88d5
SHA512a251c8e9ddf7467ee13166d0714bdaf64b23ac7bbddd3e885e67977c5404e25426ebb08f2386cb3d1d3b405b877c63f45e85bf5b05dc8a3bc65994f46368f0d9
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB