Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26-04-2024 06:23

General

  • Target

    Document.doc.scr

  • Size

    194KB

  • MD5

    6fd558cf3add096970e15d1e62ca1957

  • SHA1

    78e95fabcfe8ef7bb6419f8456deccc3d5fa4c23

  • SHA256

    41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898

  • SHA512

    fac7efe9b76f9b6a917f8751f5be64ad8e067e5404fe05f3e9d7781ea3661a06c0baaac676a6023eb4a0b7f01bc2bb2d64d572f85aec8ad8de35cc7f106e1fdc

  • SSDEEP

    3072:n6glyuxE4GsUPnliByocWepMhJL4BFkTGX:n6gDBGpvEByocWeyhJL4UK

Malware Config

Signatures

  • Renames multiple (325) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Document.doc.scr
    "C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\ProgramData\2A7A.tmp
      "C:\ProgramData\2A7A.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2A7A.tmp >> NUL
        3⤵
          PID:560
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x14c
      1⤵
        PID:2244

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini

        Filesize

        129B

        MD5

        44ef78b98b217dffc54fda8f84d808c2

        SHA1

        00517f96bab3cee471754f7f6a9ffa42cb572529

        SHA256

        4cd602996e3d632a867a2b56ff693420073a8a89240414e95784381d155c3811

        SHA512

        c5fd7fad81844620e5ce9dd397a3e8b0abd1be0e31f5732c15d7615514d24b190abcd8d883321636746d56b6d912989cde3fe57b00c24b168f72e2c6b03a099f

      • C:\AAtvmKv4L.README.txt

        Filesize

        434B

        MD5

        b4709a56b9d7f431da172316cda720be

        SHA1

        d2132f7129a7003ec4c0392f0f08cd24ea353da6

        SHA256

        192d1e6078570865531e8a4c9840a483c4a2ac35fe468107284991f6da813191

        SHA512

        e390d51e95db5e56c666a2895dc87dab41d97e7ce3c0df1f2466abf14a651167232521ab5f52746d16bab0ef14e6c0ee9dcfe29894604d695b0d064909378227

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDD

        Filesize

        194KB

        MD5

        c8d01d0da94a60f2c72a6a58b2057a37

        SHA1

        c7f2de738ed00f663a53d6fc3ba49da1f8c798c8

        SHA256

        5476b0e14e99754f077edac278246b3ab239b924a3dcbabbaaf5123bb5485d17

        SHA512

        61ae7429694881e3f3508d496187f6c22a732f4c22d93ad07d0aea2d20276de6ae3498bbaf890c76130582a92514e284f7e3f565a4fdb57a234399208b0b912c

      • F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\EEEEEEEEEEE

        Filesize

        129B

        MD5

        e04c53a84919d610f3939e248bbfd98e

        SHA1

        c4dfe3b4dd78878f60365adbd13deee869c189d3

        SHA256

        bccc847b1788934aecdc7fc567ba8325e017dc42ce13485079b6848450f67074

        SHA512

        ff0c77b95c823085f9bbdde2620f429ec193e005ded7f3d5e55cff9dbe713e3ec234c33a38079688f91fd69e38404b29109dfc83c18d6f3958a0fa2e41e69bbe

      • \ProgramData\2A7A.tmp

        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      • memory/868-852-0x00000000020F0000-0x0000000002130000-memory.dmp

        Filesize

        256KB

      • memory/868-851-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

      • memory/868-859-0x00000000020F0000-0x0000000002130000-memory.dmp

        Filesize

        256KB

      • memory/868-863-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

      • memory/868-864-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

      • memory/868-884-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

      • memory/868-885-0x000000007EF60000-0x000000007EF61000-memory.dmp

        Filesize

        4KB

      • memory/2420-0-0x0000000000CB0000-0x0000000000CF0000-memory.dmp

        Filesize

        256KB