Analysis
-
max time kernel
78s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-uk -
resource tags
-
submitted
04-10-2024 07:30
General
-
Target
Document.doc.scr
-
Size
194KB
-
MD5
ae811bd6440b425e6777f0ca001a9743
-
SHA1
70902540ead269971e149eaff568fb17d04156af
-
SHA256
86e17aa882c690ede284f3e445439dfe589d8f36e31cbc09d102305499d5c498
-
SHA512
3617d8e77c221525125778cf64f2525136f7958766f5bed0fd7bfe00e7f738017d2840972acc628e4c3471b93cf6d52ccd619f49bdbbcff824c12cac8e1ea88e
-
SSDEEP
3072:a6glyuxE4GsUPnliByocWepiHkZmlkQIQP6fo:a6gDBGpvEByocWeQwLAPm
Malware Config
Signatures
-
Renames multiple (644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.doc.scr"C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\E773.tmp"C:\ProgramData\E773.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E773.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{74CC7FAC-213B-4289-B200-B2BF8C144733}.xps" 1337250062532500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultffff61f1h1bd3h4161h8347hbee44d4c63bf1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd18b446f8,0x7ffd18b44708,0x7ffd18b447182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,5703629473803679396,9227865595551269251,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,5703629473803679396,9227865595551269251,131072 --lang=uk --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,5703629473803679396,9227865595551269251,131072 --lang=uk --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc1⤵
-
C:\Windows\System32\FodHelper.exeC:\Windows\System32\FodHelper.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD59c560fedadb82ebe7dc60040bdbae1f9
SHA155b7d13d66f75604b3de5d1b9a0113a527949f17
SHA25600f7f20cfc1cdfe0c4459d5084dbbb6dfe48eb8f99685dab7f3632e30a149a19
SHA512c7ad53183be5d9ccf5aeb481b1caf70b075c5d211be4ef741adaf8c59dc6cc7958ff611d7634236f90a25a652f94f5d15702e5b17f26a7891d31fe7ad9c28a57
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
5KB
MD5f66e84c4be84e9c741fc2923ac6c573d
SHA1b7fe252b080b82db6f08705741890c935fbe0620
SHA2565857dcc9c5ff4b97960e9ebc713c3935be9dc05871e31dc23cbdc3a155b1388e
SHA512ea2dc5f4b34908e60581fb00fa4414c5bc991deb60a971814f951b751bc0bc34e2a86f5a5d4cfb859f33dbeb4bd09d83290d5d1d296e86de9c63999bafcfa1b6
-
Filesize
8KB
MD54220e0d85f87648646015133f3bd4873
SHA1e2c461e1020635c7c0a114272a51ae7cc8ebb839
SHA2564d6d006a40a7944041dadcb87060f9c0c3d419dfd90029918d25dca4c05552a5
SHA512265ba4d4b09764434d88f64fa10ce7922117e21a9022f8386b778fa4199d4b8d9a82fccee783c3703c07861172f1919d4bd90bc03e860325dc4b62a57da46b13
-
Filesize
194KB
MD54cf43c4a3d6e21d5bcff99abe380d1cd
SHA14e01ccc3eb4157ab7fa7bc518aa2f7bded1e1b57
SHA25685bc17ca90dbedd988451fb96394343708e73b29306d81f422c849d343146da3
SHA512515316e1d3bcea03f0b8b854b908ff061131780804572af49f907d61c34e811cf842b66fc4c401347ce46931816b0ce91dfc565ae8f605c282c0d2f9286133be
-
Filesize
4KB
MD5bb27a9845891ab927beeb88d0e210993
SHA135f5059113a0172e41d564d856002ebc3a2f7634
SHA2561aeca5c5a9064206191d6613be9827b037e935999414c7c71728df57b3c1f916
SHA5122ae69fa1cadabfc4ce27b37fabcec43bb8cdbe570f9fa2f703d04ace80783eb893ea976a222d0957cabfb6e193a70ec6ee5dfa1c303458b0f68b233a1f10194d
-
Filesize
4KB
MD51389fd7b8e6d19e8c6714bd74217e8a9
SHA1abcc4768b8f26781d63d2560540cb3f8d296204f
SHA2565cc1ae254709467d999c23b74de42172b7e6eb75d51bc769d855220b331811a6
SHA512600327c7d7c2e77219feb6ad0ab45b9a35bef574b8456426029b545d9b1a73105b08b73139ea31dbe0f926d5ada4652fa4bc397f562b7929002e784b5a722df0
-
Filesize
449B
MD5c2f46db865b0ba6ef8f9385cf458a56e
SHA10b2f94fcf38ef15f59bb86a3296b7da514b4ac4e
SHA256c25759e6083dd4bf592a6da2063c45def5adc9a6ef2ed15820128a0d838f70fe
SHA5129927b209ca26e3243fac9f003c6af7663ba84405346fbdb66c6f401387cd20ea3f99d63d0858ebdc76f2e6bc722d41e2a1f599bc6f7d97b0687dba95dea31b39
-
Filesize
129B
MD556eaf04ccd30adeb5fbb9250cc6693c4
SHA1578126d877b586968192762a5970f9333d869a7a
SHA256dde2bdb8356d51f4391f4cbc7a26a7ec298ee2587204394e143ed19a372e3455
SHA51290668930727f38f0f7dae26dd637c1d12f8e57fa42fd009ff1fe994336ce7b9c6e30885e062a669c5e232dded528ecd0d9df720c8194d6bd4e9db5c8a49b6172
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB