Overview

overview

10

Static

static

10

Document.doc.scr

windows10-2004-x64

9

Resubmissions

27-08-2024 11:34

240827-npnywazgjp 10

25-04-2024 15:35

240425-s1rw5aca8y 10

Analysis

  • max time kernel
    150s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-08-2024 11:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Document.doc.scr

  • Size

    194KB

  • MD5

    ae811bd6440b425e6777f0ca001a9743

  • SHA1

    70902540ead269971e149eaff568fb17d04156af

  • SHA256

    86e17aa882c690ede284f3e445439dfe589d8f36e31cbc09d102305499d5c498

  • SHA512

    3617d8e77c221525125778cf64f2525136f7958766f5bed0fd7bfe00e7f738017d2840972acc628e4c3471b93cf6d52ccd619f49bdbbcff824c12cac8e1ea88e

  • SSDEEP

    3072:a6glyuxE4GsUPnliByocWepiHkZmlkQIQP6fo:a6gDBGpvEByocWeQwLAPm

Score
9/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (650) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Document.doc.scr
    "C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:4564
    • C:\ProgramData\C0EF.tmp
      "C:\ProgramData\C0EF.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C0EF.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4492
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:5084
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4372
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{F48BFD42-4CC0-48F9-95D6-160DDA1EACAC}.xps" 133692320859010000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:432

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\QQQQQQQQQQQ
      Filesize

      129B

      MD5

      af02e68b09f63c0327e79437130fc9bf

      SHA1

      79406acefb1486650ec735db7564e422c669ec24

      SHA256

      0ae4ba46b8efb7d64a90da94f538590b71f1d1219a698012f6c20cdfa8364fa4

      SHA512

      ac2f52eca92030eec9caad6d75ad2c54fceb1357a209f6cff17ceb598de3873a64e23d5c930f367232230c250622430ecf4884089b52181ef6779a00d495b9ff

      Download Submit

    • C:\ProgramData\C0EF.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEE
      Filesize

      194KB

      MD5

      d0fb54a907d4066d3d26eea25a10c8dc

      SHA1

      cfafd05848a34b036b5d314a336934d4fae3b448

      SHA256

      c4431221cae694328a852d21b6368e33b6a3001b501d6e68d88ccdc7ccd0e79c

      SHA512

      b1cf19633eec139c784293efa4532d3815634b6759718bd8d98a22923f83f89beb8c9c9b84f6add187d77626af9089ef880a48024502d512febf80b19a973a9f

      Download Submit

    • C:\kZd6jLIwz.README.txt
      Filesize

      449B

      MD5

      c2f46db865b0ba6ef8f9385cf458a56e

      SHA1

      0b2f94fcf38ef15f59bb86a3296b7da514b4ac4e

      SHA256

      c25759e6083dd4bf592a6da2063c45def5adc9a6ef2ed15820128a0d838f70fe

      SHA512

      9927b209ca26e3243fac9f003c6af7663ba84405346fbdb66c6f401387cd20ea3f99d63d0858ebdc76f2e6bc722d41e2a1f599bc6f7d97b0687dba95dea31b39

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-2718105630-359604950-2820636825-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      b89285b34dd5d66ca4e002ad4ca79b95

      SHA1

      2d853404c859772c672569fa2510a6ec4736b1f2

      SHA256

      1ba36574a86eae96c4a8ee582f3892bc6ed1ac9e5bb35e4d3039c201515bb440

      SHA512

      d0591f4a42606988be188f92f2281676ae90d0d3dd04aa928b83762c8bc467af1f14d6e3def6ddc4e0591e42fa6c03564d0316ddd4477390bfeedf7b780674ea

      Download Submit

    • memory/432-2830-0x00007FFBE82D0000-0x00007FFBE82E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/432-2859-0x00007FFBE5F00000-0x00007FFBE5F10000-memory.dmp

      Filesize

      64KB

      Download

    • memory/432-2826-0x00007FFBE82D0000-0x00007FFBE82E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/432-2829-0x00007FFBE82D0000-0x00007FFBE82E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/432-2828-0x00007FFBE82D0000-0x00007FFBE82E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/432-2827-0x00007FFBE82D0000-0x00007FFBE82E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/432-2899-0x00007FFBE82D0000-0x00007FFBE82E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/432-2898-0x00007FFBE82D0000-0x00007FFBE82E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/432-2897-0x00007FFBE82D0000-0x00007FFBE82E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/432-2860-0x00007FFBE5F00000-0x00007FFBE5F10000-memory.dmp

      Filesize

      64KB

      Download

    • memory/432-2900-0x00007FFBE82D0000-0x00007FFBE82E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3372-2-0x0000000002F30000-0x0000000002F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3372-0-0x0000000002F30000-0x0000000002F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3372-1-0x0000000002F30000-0x0000000002F40000-memory.dmp

      Filesize

      64KB

      Download