aa77cb573aa734527d1656e40fb7b971e5d1b3a30b213e460bd0de85ed00d05c | Triage

Analysis

max time kernel
15s
max time network
19s
platform
windows10-1703_x64
resource
win10-20240404-fr
resource tags

arch:x64arch:x86image:win10-20240404-frlocale:fr-fros:windows10-1703-x64systemwindows
submitted
16-05-2024 08:35

Sharing

Report Analysis Logs

General

Target

Tableau excel compta/excel.exe
Size

8.7MB
MD5

d3fbb9683e3122c5df40b6b8a381f076
SHA1

0fc12361a0165255b466d35916053d3770b86d20
SHA256

b8f08ac8a1c7aeced3b34c44f6428c51e27fa588f40dceb11f84fd1356828813
SHA512

240eab7f9b3eb6d0d16e9beb323b3367ee685f1bf3057785595ed9e676791192caab7946719989fe62445ef4001f07bb92be6d1fc37d8682cd60eb5c7ef82f2c
SSDEEP

196608:shDivrHisAV5GrgSYb8w8ehA+uWJysVYvsOXoyMxxvjDDAxgIE8Ggx:djHiV8YI62WJooyMxtDDAxgIp

Score

7^/10

ransomware

Malware Config

Signatures

Loads dropped DLL 20 IoCs

pid	Process
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe
4568	excel.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

Defacement

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Tableau excel compta\\bg.jpg"	excel.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4568	4796	excel.exe	74
PID 4796 wrote to memory of 4568	4796	excel.exe	74

C:\Users\Admin\AppData\Local\Temp\Tableau excel compta\excel.exe
"C:\Users\Admin\AppData\Local\Temp\Tableau excel compta\excel.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\Tableau excel compta\excel.exe
  "C:\Users\Admin\AppData\Local\Temp\Tableau excel compta\excel.exe"
  2⤵
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI47962\VCRUNTIME140.dll

Filesize
87KB

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47962\_ctypes.pyd

Filesize
120KB

MD5
f1e33a8f6f91c2ed93dc5049dd50d7b8

SHA1
23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4

SHA256
9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4

SHA512
229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47962\base_library.zip

Filesize
821KB

MD5
f4981249047e4b7709801a388e2965af

SHA1
42847b581e714a407a0b73e5dab019b104ec9af2

SHA256
b191e669b1c715026d0732cbf8415f1ff5cfba5ed9d818444719d03e72d14233

SHA512
e8ef3fb3c9d5ef8ae9065838b124ba4920a3a1ba2d4174269cad05c1f318bc9ff80b1c6a6c0f3493e998f0587ef59be0305bc92e009e67b82836755470bc1b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47962\certifi\cacert.pem

Filesize
285KB

MD5
d3e74c9d33719c8ab162baa4ae743b27

SHA1
ee32f2ccd4bc56ca68441a02bf33e32dc6205c2b

SHA256
7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92

SHA512
e0fb35d6901a6debbf48a0655e2aa1040700eb5166e732ae2617e89ef5e6869e8ddd5c7875fa83f31d447d4abc3db14bffd29600c9af725d9b03f03363469b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47962\python38.dll

Filesize
4.0MB

MD5
d2a8a5e7380d5f4716016777818a32c5

SHA1
fb12f31d1d0758fe3e056875461186056121ed0c

SHA256
59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9

SHA512
ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\_bz2.pyd

Filesize
82KB

MD5
3dc8af67e6ee06af9eec52fe985a7633

SHA1
1451b8c598348a0c0e50afc0ec91513c46fe3af6

SHA256
c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929

SHA512
da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\_cffi_backend.cp38-win_amd64.pyd

Filesize
177KB

MD5
77b5d28b725596b08d4393786d98bd27

SHA1
e3f00478de1d28bc7d2e9f0b552778be3e32d43b

SHA256
f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c

SHA512
d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\_hashlib.pyd

Filesize
44KB

MD5
a6448bc5e5da21a222de164823add45c

SHA1
6c26eb949d7eb97d19e42559b2e3713d7629f2f9

SHA256
3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a

SHA512
a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\_lzma.pyd

Filesize
246KB

MD5
37057c92f50391d0751f2c1d7ad25b02

SHA1
a43c6835b11621663fa251da421be58d143d2afb

SHA256
9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764

SHA512
953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\_queue.pyd

Filesize
27KB

MD5
44b72e0ad8d1e1ec3d8722088b48c3c5

SHA1
e0f41bf85978dd8f5abb0112c26322b72c0d7770

SHA256
4aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e

SHA512
05853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\_socket.pyd

Filesize
77KB

MD5
d6bae4b430f349ab42553dc738699f0e

SHA1
7e5efc958e189c117eccef39ec16ebf00e7645a9

SHA256
587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef

SHA512
a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\_ssl.pyd

Filesize
115KB

MD5
8ee827f2fe931163f078acdc97107b64

SHA1
149bb536f3492bc59bd7071a3da7d1f974860641

SHA256
eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4

SHA512
a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\charset_normalizer\md.cp38-win_amd64.pyd

Filesize
10KB

MD5
38105df780eddd734027328e0dca0ca3

SHA1
45f1d9e3472478f8e1ba86675f5c81c00b183bea

SHA256
9512896233d2119e78e2e1fcfd83643b2be2b427f08d16fc568fe98b9d4913cb

SHA512
ba2a05c236ce47d87888f618be2b23532d0d882578707b07ae220a96883b468f7088a19ebbe3bac2adf4035da6b7ee6fa9e57b620e2bc67b28e54cd969d6bbb3

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

Filesize
116KB

MD5
073f09e1edf5ec4173ce2de1121b9dd1

SHA1
6cdb2559a1b706446cdd993e6fd680095e119b2e

SHA256
7412969bfe1bca38bbb25bab02b54506a05015a4944b54953fcfdb179ec3f13c

SHA512
70a1a766001ec78a5fce7eadf6cae07f11b3ca6b08115e130c77d024524879577ccab263c596102102b1569933c601592fbb5ee07c7db123bb850965ef8e8e96

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\cryptography\hazmat\bindings\_rust.pyd

Filesize
6.9MB

MD5
a464617aef393d2d67690c4db55414a7

SHA1
00a70e5592ed41bb3082de6e26873f4ebca4b329

SHA256
9029825852300e1de0f6b5bb31df9ba3a847da517750088e1a96d01b6cd4e71a

SHA512
3ba39f6649035e8d42ba2908e83b72b765e2a4d26def97feb25b62193f6c5fca8688dcf91d27ace1eb9fb7b0059650b9a05247338be1e54c2475e7a6fd048e1f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\libcrypto-1_1.dll

Filesize
3.2MB

MD5
bf83f8ad60cb9db462ce62c73208a30d

SHA1
f1bc7dbc1e5b00426a51878719196d78981674c4

SHA256
012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d

SHA512
ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\libffi-7.dll

Filesize
32KB

MD5
4424baf6ed5340df85482fa82b857b03

SHA1
181b641bf21c810a486f855864cd4b8967c24c44

SHA256
8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79

SHA512
8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\libssl-1_1.dll

Filesize
670KB

MD5
fe1f3632af98e7b7a2799e3973ba03cf

SHA1
353c7382e2de3ccdd2a4911e9e158e7c78648496

SHA256
1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b

SHA512
a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\python3.dll

Filesize
57KB

MD5
7acec875d5672e7aa148b8c40df9aa49

SHA1
96b8cfabe0cfa3df32995919ac77cfdeec26f1f2

SHA256
d96858e433f45917499dbf5e052e56f079ff9ae259fd3caa025c3b1daf852891

SHA512
1208da62fe82b779ec822ad702f9ca4321b34ee590c28e10efe9a2db6d582bfdcae01ab2431c1a98714ef0c60434d64c58f3db31bf5886efbb943adc70d6e975

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\select.pyd

Filesize
26KB

MD5
6ae54d103866aad6f58e119d27552131

SHA1
bc53a92a7667fd922ce29e98dfcf5f08f798a3d2

SHA256
63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88

SHA512
ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI47962\unicodedata.pyd

Filesize
1.0MB

MD5
4c0d43f1a31e76255cb592bb616683e7

SHA1
0a9f3d77a6e064baebacacc780701117f09169ad

SHA256
0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8

SHA512
b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778

Download Submit