Resubmissions
30-04-2024 10:29
240430-mjb7fshh74 1026-04-2024 02:29
240426-cytpyahd23 1026-04-2024 02:23
240426-cvm3zshc82 1025-04-2024 03:51
240425-eekn2aeg39 10Analysis
-
max time kernel
147s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
26-04-2024 02:23
General
-
Target
Document.doc.scr
-
Size
194KB
-
MD5
50e5dec57451005668704281688ca55d
-
SHA1
67dd4ac7eb8c193b39149b34d3a0d5bc21c3f200
-
SHA256
062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1
-
SHA512
29ca4a44795c71d3e2b4e3417355ebb93765157d464d6d5a3fe6774056d934d57081c72001fb29e47982da11e5a5ccfdbcc958d05a11fb49bd8bf84e6d0c61ad
-
SSDEEP
3072:66glyuxE4GsUPnliByocWepRGbVZqid91h2ys+tU:66gDBGpvEByocWeubV4inP9B
Malware Config
Signatures
-
Renames multiple (605) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.doc.scr"C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\3B.tmp"C:\ProgramData\3B.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3B.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{B7B64BCE-9523-4063-AF55-AC6BA15FCF4F}.xps" 1335857185771600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5903a9a46fc565c6051c59a9c293c375e
SHA14290e722775c2db172fa740defd5e1ab8db072a2
SHA25628c3486a4a5b880f6d76504bc8ccb344a722910916f19186df09988602a241f9
SHA5121f5574b63362126b13956e1dec6eaef24137c50d904c592ba88d1eaf482d17f9ed3e4c559ceb5783b5faad21cfe2badc97a958418120e65cf06e4d9bfa756926
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
434B
MD5ad29bd8c66e114ff57c943d16c78f72a
SHA15ab070ee89a36f38facae4dfc8ec5ce3e59af46e
SHA2566fe668fe8bf69158d1fd08e90f3cff60c1df410bf752635bf152853b6112549c
SHA512a53121e2379aa9c3bc52d073498a54f26383834f6d6636b4b3831010565c80bf0da07511907eab7bd92f9796e559958b1c0ebea4c4b0f0d869e95b7deb5da7f1
-
Filesize
13.0MB
MD598bcbaa346a174966b7cd02f1792b530
SHA127d5849bc51ce7845cd79c0a933fbc1ab341f962
SHA2569f49f391ad707e548be4040426eabe37e580109cf4ceb22da9fccc69a9f58556
SHA512ea49eac3c99707213a8be1214f06a9ce7a8416be778ee86e783dc42a6a4e20be8c01e672a28dc748677cab7320aa4386312f7835f44e8948fe99e0e78cf9a382
-
Filesize
194KB
MD5d86dcdad0cb64a86a2505a327b9e4c6b
SHA1bce94eb754eff00f067340fccc66e3c9fe6f002a
SHA2563a6c9070e39550d9c26527a602ba5a06ae55ae58281623744305a344c5c0bca1
SHA5127124130eca9474c55dcc8151ed7beb0ba66d1bc4b4265a1abd72d152e93b0d011fce0dabbbb6ee8bd1d536f1e92b110dcb4108a69c966f50bc55cd1dca2587ac
-
Filesize
4KB
MD5b86604d9c8be82a0a3e5cd48ab552c23
SHA111c5c0880bda4e83344196bca71977e063e2adb1
SHA256c3a3cd31e25f365b859a55a2b85e9594eb2021f73974b121cb145616ada88139
SHA51266b7bbde29879a571714e3b15b08d4a34c6d5751a850147b737e4e06b62889c1cd96deed1fdb09b86e482b9a471a75ef144354eb3563f1d46ab72a6ba7172afd
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
4KB
MD5d076a1aeb39e5943017e4da805881ee0
SHA1ca66962413c68eee055fc477598abe5994fcb7ea
SHA256990d4a18098a4d38152c916ef213a60a163f7d99682fa48382471353407d662e
SHA512235764bd349792e23f357032d07fb6485a081b7ca8683beb87bff40495932f828a9719dc43aef5eb11a53890f2eb1ce04be8738d28dd57685bc319fb00d1bdd3
-
Filesize
129B
MD52f70967389be75652aac0b90533a82ee
SHA1f0842c73d8ef34185f8cacfa238c8388499b8c8d
SHA256e610261c9e331e40ff0dee60a0ee8d8a8a1d06c0029e50c47f4ac13a3f04acde
SHA5123c4a90656b4f198f51b4a8f4b8f1db95b4031a7116baaab93421c087d4b24819b616f90a03fa5b51442d286233dd339fa1a48067ee5ea434414a94c9f77e4f3d
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB