Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26-04-2024 06:20

General

  • Target

    Document.doc.scr

  • Size

    194KB

  • MD5

    6fd558cf3add096970e15d1e62ca1957

  • SHA1

    78e95fabcfe8ef7bb6419f8456deccc3d5fa4c23

  • SHA256

    41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898

  • SHA512

    fac7efe9b76f9b6a917f8751f5be64ad8e067e5404fe05f3e9d7781ea3661a06c0baaac676a6023eb4a0b7f01bc2bb2d64d572f85aec8ad8de35cc7f106e1fdc

  • SSDEEP

    3072:n6glyuxE4GsUPnliByocWepMhJL4BFkTGX:n6gDBGpvEByocWeyhJL4UK

Malware Config

Signatures

  • Renames multiple (314) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Modifies Control Panel 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Document.doc.scr
    "C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\ProgramData\1BCA.tmp
      "C:\ProgramData\1BCA.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1BCA.tmp >> NUL
        3⤵
          PID:1880
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:896

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini

        Filesize

        129B

        MD5

        174c9117892ffe3c366809dfce76bc11

        SHA1

        18b7526e6adc46e1ab3a6c46bc2c4507e07797e9

        SHA256

        7ca910b387890cecf7bfc979bbf27b441af4ec2d40c5c248428fa3f913c78adf

        SHA512

        d8698ea5376e8808cb7af019d68972536caafe45c35cc92610e1de68a68f6d0705ebb0909f391bcc87b9799e793aa292461cf2a65b34c0dd0d0a92104165164d

      • C:\AAtvmKv4L.README.txt

        Filesize

        434B

        MD5

        b4709a56b9d7f431da172316cda720be

        SHA1

        d2132f7129a7003ec4c0392f0f08cd24ea353da6

        SHA256

        192d1e6078570865531e8a4c9840a483c4a2ac35fe468107284991f6da813191

        SHA512

        e390d51e95db5e56c666a2895dc87dab41d97e7ce3c0df1f2466abf14a651167232521ab5f52746d16bab0ef14e6c0ee9dcfe29894604d695b0d064909378227

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDD

        Filesize

        194KB

        MD5

        fcb783cf0a367e56f800896a1b7d634a

        SHA1

        2183b9c3231df0ab2c3588115a8f6119b7ca63e3

        SHA256

        2261659485161e4d318b411d1caf3d05e860c23b53f9aa6715e41bc8909b4c87

        SHA512

        9b9d34954f80a51e4b6258f2a8af051976d36d8d8824d68d773caa297cde6e915d515408c29eb6e63a83ce55fe1c2db3907eb108b0617d6805f3da5bf30a2873

      • F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\DDDDDDDDDDD

        Filesize

        129B

        MD5

        00cf885f30dacfba83ece115d402af3f

        SHA1

        c2dda5a172a7ceae9c39e5000a8e21ea864e7307

        SHA256

        b985dd1c32899085a7b78c02fd5af455d2d166f379d05ffad74afad32faa56c8

        SHA512

        21b77e0a78f1afc615241fa2f0c9361d85ddb554fb0b782cad031730669f6d6c92b12177da2a8d63b1bf970ef1c2b003dbcf08c57f8eb93d28e963f1b8a19d44

      • \ProgramData\1BCA.tmp

        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      • memory/1256-833-0x00000000020C0000-0x0000000002100000-memory.dmp

        Filesize

        256KB

      • memory/1256-838-0x00000000020C0000-0x0000000002100000-memory.dmp

        Filesize

        256KB

      • memory/1256-840-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

      • memory/1256-841-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

      • memory/1256-832-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

      • memory/1256-865-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

      • memory/1256-866-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

      • memory/2196-0-0x00000000021F0000-0x0000000002230000-memory.dmp

        Filesize

        256KB