d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996

General

Target

d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996.exe
Size

2.0MB
MD5

392b007a9adcd0cbe5f9aa438f71988b
SHA1

7ce8cb766cf96ed6ffebc4fb9998236779e2e1a4
SHA256

d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996
SHA512

61aa26eb4b107967d31d56746d1c5ad7cb7b9320f9c464651bac5e6467933d5ce72c94b3cf3fea7de51b4372e48eb077016f983753b08b1451326e3a0922e916
SSDEEP

49152:OFUcx88PWPOpX0SFMFZviwpbiR+M+Pynh0FyGE:O+K88uPCHIZvJpbj2hWyGE

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	925D.tmp

Executes dropped EXE 1 IoCs

pid	Process
3780	925D.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	925D.tmp

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	925D.tmp

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4796	WINWORD.EXE
4796	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3780	925D.tmp

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 3780	452	d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996.exe	82
PID 452 wrote to memory of 3780	452	d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996.exe	82
PID 452 wrote to memory of 3780	452	d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996.exe	82
PID 3780 wrote to memory of 4796	3780	925D.tmp	86
PID 3780 wrote to memory of 4796	3780	925D.tmp	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996.exe
"C:\Users\Admin\AppData\Local\Temp\d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\925D.tmp
  "C:\Users\Admin\AppData\Local\Temp\925D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996.exe 9E27D00E573F9F2145E10E4C5B9EC14816BD46B5222C4EBEB382796399055645FED66B4F5C1B9AD6B4E710D441D6C0EE1A80B1E4E5E3CA7DBD1C4ACE9FCFD4CD
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\925D.tmp

Filesize
2.0MB

MD5
561a611bd909e4b80cd75be112b2b84c

SHA1
f384609760d8926468ba713d32895f58a2d90602

SHA256
4cd8642592ef4405181c935e9709c1fbb4ce56744fefc1518fb19178632ab2af

SHA512
78a619f59aa3df5f3c34f9683805298f7234d1b322e1755ac3374e1c8e320fb39eb5677184d39f85997aa70db599e4431aa338e31a870e5ddcef4f6a39e99917

Download Submit
C:\Users\Admin\AppData\Local\Temp\d9524613bb056636365b5d486a51bcc06c678119847e7f4ee8dff0fea1e1d996.docx

Filesize
19KB

MD5
4046ff080673cffac6529512b8d3bdbb

SHA1
d3cbc39065b7a55e995fa25397da2140bdac80c1

SHA256
f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680

SHA512
453f70730b7560e3d3e23ddfa0fe74e014753f8b34b45254c1c0cf5fec0546a2b8b109a4f9d096e91711b6d02cb383a7136c2cb7bd6600d0598acf7c90c25418

Download Submit
memory/452-0-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/3780-5-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/4796-22-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download
memory/4796-27-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download
memory/4796-13-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp

Filesize
64KB

Download
memory/4796-12-0x00007FFEA2CCD000-0x00007FFEA2CCE000-memory.dmp

Filesize
4KB

Download
memory/4796-15-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp

Filesize
64KB

Download
memory/4796-23-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download
memory/4796-24-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download
memory/4796-25-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download
memory/4796-11-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp

Filesize
64KB

Download
memory/4796-26-0x00007FFE607C0000-0x00007FFE607D0000-memory.dmp

Filesize
64KB

Download
memory/4796-21-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download
memory/4796-14-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp

Filesize
64KB

Download
memory/4796-20-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download
memory/4796-28-0x00007FFE607C0000-0x00007FFE607D0000-memory.dmp

Filesize
64KB

Download
memory/4796-19-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download
memory/4796-18-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download
memory/4796-17-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download
memory/4796-16-0x00007FFE62CB0000-0x00007FFE62CC0000-memory.dmp

Filesize
64KB

Download
memory/4796-43-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download
memory/4796-44-0x00007FFEA2CCD000-0x00007FFEA2CCE000-memory.dmp

Filesize
4KB

Download
memory/4796-45-0x00007FFEA2C30000-0x00007FFEA2E25000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads