59561642f32679da96576e2ce946233f8ca58e0ddc07f3047e08a1177a471a8c

General

Target
ramnitsingle.vbs
Size 110KB
Sample220301-w8b3esbbd5
SHA256 59561642f32679da96576e2ce946233f8ca58e0ddc07f3047e08a1177a471a8c
MD5 de687e52085477b200c98fbda93505dc
SHA1 433c2461d156ea76d2eb1f9740f5e17ed4c31e67
SHA512 b960ab41c6138f30be4aec3604981c75d191d5da746104154e500be90687b9bfcc637c1e08a7e2ed74794e03db7aee1a4c2a875dc2f12509a28da5fbae6c5498
MD5 SHA1 SHA512

Score

10^/10

upx

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3204 created 1872	3204	WerFault.exe	58

Executes dropped EXE 1 IoCs

pid	Process
1872	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000400000002141c-130.dat	upx
behavioral2/files/0x000400000002141c-131.dat	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2488	1872	WerFault.exe	58

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2488	WerFault.exe
2488	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2488	WerFault.exe
Token: SeBackupPrivilege	2488	WerFault.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 1872	64	WScript.exe	58
PID 64 wrote to memory of 1872	64	WScript.exe	58
PID 64 wrote to memory of 1872	64	WScript.exe	58
PID 3204 wrote to memory of 1872	3204	WerFault.exe	58
PID 3204 wrote to memory of 1872	3204	WerFault.exe	58

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ramnitsingle.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:64
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 232
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1872 -ip 1872
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads