Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-04-2024 06:20
Behavioral task
behavioral1
Sample
Document.doc.scr
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Document.doc.scr
Resource
win10v2004-20240412-en
General
-
Target
Document.doc.scr
-
Size
194KB
-
MD5
6fd558cf3add096970e15d1e62ca1957
-
SHA1
78e95fabcfe8ef7bb6419f8456deccc3d5fa4c23
-
SHA256
41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898
-
SHA512
fac7efe9b76f9b6a917f8751f5be64ad8e067e5404fe05f3e9d7781ea3661a06c0baaac676a6023eb4a0b7f01bc2bb2d64d572f85aec8ad8de35cc7f106e1fdc
-
SSDEEP
3072:n6glyuxE4GsUPnliByocWepMhJL4BFkTGX:n6gDBGpvEByocWeyhJL4UK
Malware Config
Signatures
-
Renames multiple (314) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
1BCA.tmppid process 1256 1BCA.tmp -
Executes dropped EXE 1 IoCs
Processes:
1BCA.tmppid process 1256 1BCA.tmp -
Loads dropped DLL 1 IoCs
Processes:
Document.doc.scrpid process 2196 Document.doc.scr -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
Document.doc.scrdescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini Document.doc.scr File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini Document.doc.scr -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
Document.doc.scrdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\AAtvmKv4L.bmp" Document.doc.scr Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\AAtvmKv4L.bmp" Document.doc.scr -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
Document.doc.scr1BCA.tmppid process 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 1256 1BCA.tmp -
Modifies Control Panel 2 IoCs
Processes:
Document.doc.scrdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop Document.doc.scr Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\WallpaperStyle = "10" Document.doc.scr -
Modifies registry class 5 IoCs
Processes:
Document.doc.scrdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.AAtvmKv4L Document.doc.scr Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.AAtvmKv4L\ = "AAtvmKv4L" Document.doc.scr Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AAtvmKv4L\DefaultIcon Document.doc.scr Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AAtvmKv4L Document.doc.scr Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AAtvmKv4L\DefaultIcon\ = "C:\\ProgramData\\AAtvmKv4L.ico" Document.doc.scr -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
Document.doc.scrpid process 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr 2196 Document.doc.scr -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
1BCA.tmppid process 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp 1256 1BCA.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Document.doc.scrdescription pid process Token: SeAssignPrimaryTokenPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeDebugPrivilege 2196 Document.doc.scr Token: 36 2196 Document.doc.scr Token: SeImpersonatePrivilege 2196 Document.doc.scr Token: SeIncBasePriorityPrivilege 2196 Document.doc.scr Token: SeIncreaseQuotaPrivilege 2196 Document.doc.scr Token: 33 2196 Document.doc.scr Token: SeManageVolumePrivilege 2196 Document.doc.scr Token: SeProfSingleProcessPrivilege 2196 Document.doc.scr Token: SeRestorePrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSystemProfilePrivilege 2196 Document.doc.scr Token: SeTakeOwnershipPrivilege 2196 Document.doc.scr Token: SeShutdownPrivilege 2196 Document.doc.scr Token: SeDebugPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeBackupPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr Token: SeSecurityPrivilege 2196 Document.doc.scr -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Document.doc.scr1BCA.tmpdescription pid process target process PID 2196 wrote to memory of 1256 2196 Document.doc.scr 1BCA.tmp PID 2196 wrote to memory of 1256 2196 Document.doc.scr 1BCA.tmp PID 2196 wrote to memory of 1256 2196 Document.doc.scr 1BCA.tmp PID 2196 wrote to memory of 1256 2196 Document.doc.scr 1BCA.tmp PID 2196 wrote to memory of 1256 2196 Document.doc.scr 1BCA.tmp PID 1256 wrote to memory of 1880 1256 1BCA.tmp cmd.exe PID 1256 wrote to memory of 1880 1256 1BCA.tmp cmd.exe PID 1256 wrote to memory of 1880 1256 1BCA.tmp cmd.exe PID 1256 wrote to memory of 1880 1256 1BCA.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.doc.scr"C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\ProgramData\1BCA.tmp"C:\ProgramData\1BCA.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1BCA.tmp >> NUL3⤵PID:1880
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5174c9117892ffe3c366809dfce76bc11
SHA118b7526e6adc46e1ab3a6c46bc2c4507e07797e9
SHA2567ca910b387890cecf7bfc979bbf27b441af4ec2d40c5c248428fa3f913c78adf
SHA512d8698ea5376e8808cb7af019d68972536caafe45c35cc92610e1de68a68f6d0705ebb0909f391bcc87b9799e793aa292461cf2a65b34c0dd0d0a92104165164d
-
Filesize
434B
MD5b4709a56b9d7f431da172316cda720be
SHA1d2132f7129a7003ec4c0392f0f08cd24ea353da6
SHA256192d1e6078570865531e8a4c9840a483c4a2ac35fe468107284991f6da813191
SHA512e390d51e95db5e56c666a2895dc87dab41d97e7ce3c0df1f2466abf14a651167232521ab5f52746d16bab0ef14e6c0ee9dcfe29894604d695b0d064909378227
-
Filesize
194KB
MD5fcb783cf0a367e56f800896a1b7d634a
SHA12183b9c3231df0ab2c3588115a8f6119b7ca63e3
SHA2562261659485161e4d318b411d1caf3d05e860c23b53f9aa6715e41bc8909b4c87
SHA5129b9d34954f80a51e4b6258f2a8af051976d36d8d8824d68d773caa297cde6e915d515408c29eb6e63a83ce55fe1c2db3907eb108b0617d6805f3da5bf30a2873
-
Filesize
129B
MD500cf885f30dacfba83ece115d402af3f
SHA1c2dda5a172a7ceae9c39e5000a8e21ea864e7307
SHA256b985dd1c32899085a7b78c02fd5af455d2d166f379d05ffad74afad32faa56c8
SHA51221b77e0a78f1afc615241fa2f0c9361d85ddb554fb0b782cad031730669f6d6c92b12177da2a8d63b1bf970ef1c2b003dbcf08c57f8eb93d28e963f1b8a19d44
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf