Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-04-2024 06:23
Behavioral task
behavioral1
Sample
Document.doc.scr
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Document.doc.scr
Resource
win10v2004-20240412-en
General
-
Target
Document.doc.scr
-
Size
194KB
-
MD5
6fd558cf3add096970e15d1e62ca1957
-
SHA1
78e95fabcfe8ef7bb6419f8456deccc3d5fa4c23
-
SHA256
41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898
-
SHA512
fac7efe9b76f9b6a917f8751f5be64ad8e067e5404fe05f3e9d7781ea3661a06c0baaac676a6023eb4a0b7f01bc2bb2d64d572f85aec8ad8de35cc7f106e1fdc
-
SSDEEP
3072:n6glyuxE4GsUPnliByocWepMhJL4BFkTGX:n6gDBGpvEByocWeyhJL4UK
Malware Config
Signatures
-
Renames multiple (325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
2A7A.tmppid process 868 2A7A.tmp -
Executes dropped EXE 1 IoCs
Processes:
2A7A.tmppid process 868 2A7A.tmp -
Loads dropped DLL 1 IoCs
Processes:
Document.doc.scrpid process 2420 Document.doc.scr -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
Document.doc.scrdescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini Document.doc.scr File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini Document.doc.scr -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
Document.doc.scrdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\AAtvmKv4L.bmp" Document.doc.scr Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\AAtvmKv4L.bmp" Document.doc.scr -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
Document.doc.scr2A7A.tmppid process 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 868 2A7A.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
Document.doc.scrdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop Document.doc.scr Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallpaperStyle = "10" Document.doc.scr -
Modifies registry class 5 IoCs
Processes:
Document.doc.scrdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AAtvmKv4L\DefaultIcon Document.doc.scr Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AAtvmKv4L Document.doc.scr Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AAtvmKv4L\DefaultIcon\ = "C:\\ProgramData\\AAtvmKv4L.ico" Document.doc.scr Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.AAtvmKv4L Document.doc.scr Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.AAtvmKv4L\ = "AAtvmKv4L" Document.doc.scr -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
Document.doc.scrpid process 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr 2420 Document.doc.scr -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
2A7A.tmppid process 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp 868 2A7A.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Document.doc.scrdescription pid process Token: SeAssignPrimaryTokenPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeDebugPrivilege 2420 Document.doc.scr Token: 36 2420 Document.doc.scr Token: SeImpersonatePrivilege 2420 Document.doc.scr Token: SeIncBasePriorityPrivilege 2420 Document.doc.scr Token: SeIncreaseQuotaPrivilege 2420 Document.doc.scr Token: 33 2420 Document.doc.scr Token: SeManageVolumePrivilege 2420 Document.doc.scr Token: SeProfSingleProcessPrivilege 2420 Document.doc.scr Token: SeRestorePrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSystemProfilePrivilege 2420 Document.doc.scr Token: SeTakeOwnershipPrivilege 2420 Document.doc.scr Token: SeShutdownPrivilege 2420 Document.doc.scr Token: SeDebugPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeBackupPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr Token: SeSecurityPrivilege 2420 Document.doc.scr -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Document.doc.scr2A7A.tmpdescription pid process target process PID 2420 wrote to memory of 868 2420 Document.doc.scr 2A7A.tmp PID 2420 wrote to memory of 868 2420 Document.doc.scr 2A7A.tmp PID 2420 wrote to memory of 868 2420 Document.doc.scr 2A7A.tmp PID 2420 wrote to memory of 868 2420 Document.doc.scr 2A7A.tmp PID 2420 wrote to memory of 868 2420 Document.doc.scr 2A7A.tmp PID 868 wrote to memory of 560 868 2A7A.tmp cmd.exe PID 868 wrote to memory of 560 868 2A7A.tmp cmd.exe PID 868 wrote to memory of 560 868 2A7A.tmp cmd.exe PID 868 wrote to memory of 560 868 2A7A.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.doc.scr"C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\ProgramData\2A7A.tmp"C:\ProgramData\2A7A.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2A7A.tmp >> NUL3⤵PID:560
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD544ef78b98b217dffc54fda8f84d808c2
SHA100517f96bab3cee471754f7f6a9ffa42cb572529
SHA2564cd602996e3d632a867a2b56ff693420073a8a89240414e95784381d155c3811
SHA512c5fd7fad81844620e5ce9dd397a3e8b0abd1be0e31f5732c15d7615514d24b190abcd8d883321636746d56b6d912989cde3fe57b00c24b168f72e2c6b03a099f
-
Filesize
434B
MD5b4709a56b9d7f431da172316cda720be
SHA1d2132f7129a7003ec4c0392f0f08cd24ea353da6
SHA256192d1e6078570865531e8a4c9840a483c4a2ac35fe468107284991f6da813191
SHA512e390d51e95db5e56c666a2895dc87dab41d97e7ce3c0df1f2466abf14a651167232521ab5f52746d16bab0ef14e6c0ee9dcfe29894604d695b0d064909378227
-
Filesize
194KB
MD5c8d01d0da94a60f2c72a6a58b2057a37
SHA1c7f2de738ed00f663a53d6fc3ba49da1f8c798c8
SHA2565476b0e14e99754f077edac278246b3ab239b924a3dcbabbaaf5123bb5485d17
SHA51261ae7429694881e3f3508d496187f6c22a732f4c22d93ad07d0aea2d20276de6ae3498bbaf890c76130582a92514e284f7e3f565a4fdb57a234399208b0b912c
-
Filesize
129B
MD5e04c53a84919d610f3939e248bbfd98e
SHA1c4dfe3b4dd78878f60365adbd13deee869c189d3
SHA256bccc847b1788934aecdc7fc567ba8325e017dc42ce13485079b6848450f67074
SHA512ff0c77b95c823085f9bbdde2620f429ec193e005ded7f3d5e55cff9dbe713e3ec234c33a38079688f91fd69e38404b29109dfc83c18d6f3958a0fa2e41e69bbe
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf