Overview

overview

10

Static

static

10

Document.doc.scr

windows7-x64

9

Document.doc.scr

windows10-2004-x64

9

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    26-04-2024 06:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Document.doc.scr

  • Size

    194KB

  • MD5

    50e5dec57451005668704281688ca55d

  • SHA1

    67dd4ac7eb8c193b39149b34d3a0d5bc21c3f200

  • SHA256

    062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1

  • SHA512

    29ca4a44795c71d3e2b4e3417355ebb93765157d464d6d5a3fe6774056d934d57081c72001fb29e47982da11e5a5ccfdbcc958d05a11fb49bd8bf84e6d0c61ad

  • SSDEEP

    3072:66glyuxE4GsUPnliByocWepRGbVZqid91h2ys+tU:66gDBGpvEByocWeubV4inP9B

Score
9/10
ransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (318) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Document.doc.scr
    "C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\ProgramData\1FA1.tmp
      "C:\ProgramData\1FA1.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1FA1.tmp >> NUL
        3⤵
          PID:2288
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x148
      1⤵
        PID:984

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini
        Filesize

        129B

        MD5

        cdb935c607a1ffa2c8bbf4286f66bd49

        SHA1

        b195cd33dc5f1c6d65f10fa33cee2fa699490b3a

        SHA256

        ca8cd8bff69ff30efd7bbca0e6d70584834b6115a87e0c204c84f35d89934bde

        SHA512

        8dd7a6552964408f74880e4788109ddd195e772f023900fa15fb382483fbb454b7aa512631afe2159152a49c475961801663cd341c9a41e47c91ba714fadaf63

        Download Submit

      • C:\Qs2QSInbk.README.txt
        Filesize

        434B

        MD5

        ad29bd8c66e114ff57c943d16c78f72a

        SHA1

        5ab070ee89a36f38facae4dfc8ec5ce3e59af46e

        SHA256

        6fe668fe8bf69158d1fd08e90f3cff60c1df410bf752635bf152853b6112549c

        SHA512

        a53121e2379aa9c3bc52d073498a54f26383834f6d6636b4b3831010565c80bf0da07511907eab7bd92f9796e559958b1c0ebea4c4b0f0d869e95b7deb5da7f1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDD
        Filesize

        194KB

        MD5

        37f33baa057ac5c5f3a1d62653be79f0

        SHA1

        dff71350e198f0d1f9d8ad6b78b8d1984bb7f9e6

        SHA256

        9c03e82d8e1905b420a881b942e37a06b43263a6a18f13bf2c20e71116797b5d

        SHA512

        0b1382e3fccd3986c30185f7839d848dbc58ce5a2d7f257192ec7f2ff25794748789383dff85eaec3d9ecaf39a670206de9847c2a8352335dbbb3a47649fc5f0

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        b36a8718de833d8033c0831f0cd01efc

        SHA1

        b96dd643c42d08b67fae1a9f057ab74772a5eb79

        SHA256

        dc48ef4891f9dedb94e17ecc4b8e5c8b96f07f4c2f8a3293ae8ac17c983fd79c

        SHA512

        30b5e0dbd3bd34e88138bea5aaf3f2c947254d86e8d1a450bc42638e461645528363b79b4470fb649876ccf0cbcec3b82711c3a707cdca7ae54bd7e4adc8817b

        Download Submit

      • \ProgramData\1FA1.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • memory/1868-844-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1868-845-0x0000000001FF0000-0x0000000002030000-memory.dmp

        Filesize

        256KB

        Download

      • memory/1868-847-0x000000007EF80000-0x000000007EF81000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1868-849-0x000000007EF20000-0x000000007EF21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1868-876-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1868-877-0x000000007EF40000-0x000000007EF41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3064-0-0x0000000000A00000-0x0000000000A40000-memory.dmp

        Filesize

        256KB

        Download