7e9c54a294c4bde2a405d9eed1717a20e2c182014b68aa34aef2b3d00bc1dacf

General

Target

7e9c54a294c4bde2a405d9eed1717a20e2c182014b68aa34aef2b3d00bc1dacf.elf
Size

125KB
MD5

f4a3eead7fc9ca7164d961861482da25
SHA1

b883aebf5d81024e0f6410ecc0a61fd2c2906726
SHA256

7e9c54a294c4bde2a405d9eed1717a20e2c182014b68aa34aef2b3d00bc1dacf
SHA512

3df96d8cff684392ba9fc65542e859d10466512d94c4941b02025ece52d84ac09b1eafa0b9046b8ac5875499a1ec2f1c2f20820f2ad54be157a2e43a5c08dd06
SSDEEP

3072:RJXsDiU0lpN+gt2vt/VvjbipLBP+/eylaICp:m0lpN+LvtwL3ylaTp

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\Ref	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\򘊶ɍ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\elf_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\d敲e荼넍ꌀ耀򘊶ɍ	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\elf_auto_file\shell\edit\ = "@C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\oregres.dll,-1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\Ref\ = "elf_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\򘊶ɍ\ = "elf_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\d敲e荼넍ꌀ耀򘊶ɍ\ = "elf_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\elf_auto_file\shell\edit\command\ = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\Winword.exe\" /n \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\elf_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\elf_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\elf_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\.elf	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\.elf\ = "elf_auto_file"	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3908	Winword.exe
3908	Winword.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4224	OpenWith.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
4224	OpenWith.exe
4224	OpenWith.exe
4224	OpenWith.exe
4224	OpenWith.exe
4224	OpenWith.exe
4224	OpenWith.exe
4224	OpenWith.exe
4224	OpenWith.exe
4224	OpenWith.exe
4224	OpenWith.exe
4224	OpenWith.exe
4224	OpenWith.exe
4224	OpenWith.exe
3908	Winword.exe
3908	Winword.exe
3908	Winword.exe
3908	Winword.exe
3908	Winword.exe
3908	Winword.exe
3908	Winword.exe
3908	Winword.exe
3908	Winword.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 3908	4224	OpenWith.exe	84
PID 4224 wrote to memory of 3908	4224	OpenWith.exe	84

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\7e9c54a294c4bde2a405d9eed1717a20e2c182014b68aa34aef2b3d00bc1dacf.elf
1⤵
- Modifies registry class
PID:3364

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\7e9c54a294c4bde2a405d9eed1717a20e2c182014b68aa34aef2b3d00bc1dacf.elf"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCD2D84.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
0f121896ae6bf6ca4f142ca14f8419cd

SHA1
4c201c0816b7cc59ad4d053b8b106fcaa53d061c

SHA256
7cb85fafb557bb4fbf535c01329172f1ad40e71750c648863d4ba2ab7b66899c

SHA512
791be7406047d120fb26950728d0979ab6530930988d8566bc951415e47be5f55041bdedb97a7c68f9d0941e5f476e3ea817748ddf5b2c62f696d1f425b596e9

Download Submit
memory/3908-6-0x00007FFD03C30000-0x00007FFD03C40000-memory.dmp

Filesize
64KB

Download
memory/3908-1-0x00007FFD063B0000-0x00007FFD063C0000-memory.dmp

Filesize
64KB

Download
memory/3908-0-0x00007FFD063B0000-0x00007FFD063C0000-memory.dmp

Filesize
64KB

Download
memory/3908-5-0x00007FFD03C30000-0x00007FFD03C40000-memory.dmp

Filesize
64KB

Download
memory/3908-4-0x00007FFD063B0000-0x00007FFD063C0000-memory.dmp

Filesize
64KB

Download
memory/3908-2-0x00007FFD063B0000-0x00007FFD063C0000-memory.dmp

Filesize
64KB

Download
memory/3908-3-0x00007FFD063B0000-0x00007FFD063C0000-memory.dmp

Filesize
64KB

Download
memory/3908-163-0x00007FFD063B0000-0x00007FFD063C0000-memory.dmp

Filesize
64KB

Download
memory/3908-164-0x00007FFD063B0000-0x00007FFD063C0000-memory.dmp

Filesize
64KB

Download
memory/3908-166-0x00007FFD063B0000-0x00007FFD063C0000-memory.dmp

Filesize
64KB

Download
memory/3908-165-0x00007FFD063B0000-0x00007FFD063C0000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads