Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
26-04-2024 06:54
General
-
Target
Document.doc.scr
-
Size
194KB
-
MD5
50e5dec57451005668704281688ca55d
-
SHA1
67dd4ac7eb8c193b39149b34d3a0d5bc21c3f200
-
SHA256
062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1
-
SHA512
29ca4a44795c71d3e2b4e3417355ebb93765157d464d6d5a3fe6774056d934d57081c72001fb29e47982da11e5a5ccfdbcc958d05a11fb49bd8bf84e6d0c61ad
-
SSDEEP
3072:66glyuxE4GsUPnliByocWepRGbVZqid91h2ys+tU:66gDBGpvEByocWeubV4inP9B
Malware Config
Signatures
-
Renames multiple (632) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.doc.scr"C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
C:\ProgramData\E972.tmp"C:\ProgramData\E972.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E972.tmp >> NUL3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1332 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{9F4475CC-B01E-4DB2-A67E-F4F48E3EB1E2}.xps" 1335858810338100002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a7a2783d6be313a267247887e04e7e32
SHA1799c8601d614ece933851e5a06397950a9cb9ce3
SHA256b9b7a5123405b796574d2592b12b4dccbd533a845cd895cc1f272e6e759479f9
SHA51296aaec9a4f1c1e77ec1b4fdb7c58444529afc355413478f8e6d908b7476633e245937b27d1f7f117b7af90f5e14bc90e08ffb15b6ac3731071b5116454caa04c
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
434B
MD5ad29bd8c66e114ff57c943d16c78f72a
SHA15ab070ee89a36f38facae4dfc8ec5ce3e59af46e
SHA2566fe668fe8bf69158d1fd08e90f3cff60c1df410bf752635bf152853b6112549c
SHA512a53121e2379aa9c3bc52d073498a54f26383834f6d6636b4b3831010565c80bf0da07511907eab7bd92f9796e559958b1c0ebea4c4b0f0d869e95b7deb5da7f1
-
Filesize
194KB
MD567ebfd309ec37ab646f992a75e645407
SHA1fea950f56b221ee222c2885151553e7172560f11
SHA256f24d4e6d753744104f76b45e0e85fb1ba06e099dc93a7c2c1cb52612a484dc56
SHA512935aebb4006270b9cf380c4f83cb78664c16c04562772e832041118656d0a083e866382c6d90ffd392c950903b93710c9c50bfe028855e32ba678273e75fd040
-
Filesize
4KB
MD5ebe9c18a764eb4b574d6a2204a4c5f07
SHA12ae0c3fb908c2554ad551fe6168a3fa8aad4d379
SHA256a3fec949639512e2fe6b68a97a29238e8c5fd88e58613ef53bd60894b1c0f2b2
SHA512aa173ed5fcd97452fac52f4a811f52d5e5117ff36f27a8eb3a366d19a26abc39ee4ebe53bf2bd8c19e348300b729bb0947e0ab8ac0a053f9e6e132e38538b7ac
-
Filesize
4KB
MD5961c44af6559b88492b31903451f2291
SHA1b2d9bde4062e0f2fc566a68aebc125e40dc608f7
SHA25696d320dad05952b576efdac508940d57032755041b2a8147264daeceb66ee567
SHA512313d0aa26305140e6f7ac8a2ffbb621d5948122abe85e54c560e434c92a523082b9b81d00e20f1afc5c534cf13a14f5d4bd354ce35e7b373a1c8db3c1fcfaf99
-
Filesize
129B
MD597fddab95ab410d2e0ff5992863427d7
SHA17ba1d38427d8f217ab2fa8f8db5b0102ae4d0987
SHA256315ab2b9e62f03530cc9dff05988dcd475d6374a1d8e34f8890def26627b2400
SHA512a8dc0ebf98e54967aaf8de7941990b825d37339970ff995e8b60f554c8c0a5a1c93db6961fc913fcd7276b3d44ffb67a57245e588e0335ea3ef3dc27ab7ee89b
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB