2a5fcd571c34b11c0c630c8cf1f50a91a136e931e0057f7f8e3ca36ecd73d993

General

Target

RAMN.vbs
Size

169KB
MD5

e5e7f440ae47fe295bb93034b1edf3c1
SHA1

bff968fb18c296edabf8ad52953e7c36ae0bcdea
SHA256

2a5fcd571c34b11c0c630c8cf1f50a91a136e931e0057f7f8e3ca36ecd73d993
SHA512

a45c68efa11bf061c5ed5fd09e2c616acb2333b67cb1f86382eac88ac1f2fb1120ad2517381e2125eb5a98a5d69d602918cc1ac1277cee1f5a976d8e1a3eb92b

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:enabled:@shell32.dll,-1"	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

4304 svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\svchost.exe	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1180 4304 WerFault.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

svchost.exe

pid process

4304 svchost.exe
4304 svchost.exe

pid	pid_target	process	target process
1180	4304	WerFault.exe	svchost.exe

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

svchost.exe

pid	process
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe
4304	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 4304 svchost.exe

description	pid	process
Token: SeDebugPrivilege	4304	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WScript.exesvchost.exe

description	pid	process	target process
PID 3100 wrote to memory of 4304	3100	WScript.exe	svchost.exe
PID 3100 wrote to memory of 4304	3100	WScript.exe	svchost.exe
PID 3100 wrote to memory of 4304	3100	WScript.exe	svchost.exe
PID 4304 wrote to memory of 624	4304	svchost.exe	winlogon.exe
PID 4304 wrote to memory of 624	4304	svchost.exe	winlogon.exe
PID 4304 wrote to memory of 624	4304	svchost.exe	winlogon.exe
PID 4304 wrote to memory of 624	4304	svchost.exe	winlogon.exe
PID 4304 wrote to memory of 624	4304	svchost.exe	winlogon.exe
PID 4304 wrote to memory of 624	4304	svchost.exe	winlogon.exe
PID 4304 wrote to memory of 680	4304	svchost.exe	lsass.exe
PID 4304 wrote to memory of 680	4304	svchost.exe	lsass.exe
PID 4304 wrote to memory of 680	4304	svchost.exe	lsass.exe
PID 4304 wrote to memory of 680	4304	svchost.exe	lsass.exe
PID 4304 wrote to memory of 680	4304	svchost.exe	lsass.exe
PID 4304 wrote to memory of 680	4304	svchost.exe	lsass.exe
PID 4304 wrote to memory of 796	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 796	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 796	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 796	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 796	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 796	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 804	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 804	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 804	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 804	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 804	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 804	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 812	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 812	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 812	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 812	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 812	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 812	4304	svchost.exe	fontdrvhost.exe
PID 4304 wrote to memory of 916	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 916	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 916	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 916	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 916	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 916	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 968	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 968	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 968	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 968	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 968	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 968	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 400	4304	svchost.exe	dwm.exe
PID 4304 wrote to memory of 400	4304	svchost.exe	dwm.exe
PID 4304 wrote to memory of 400	4304	svchost.exe	dwm.exe
PID 4304 wrote to memory of 400	4304	svchost.exe	dwm.exe
PID 4304 wrote to memory of 400	4304	svchost.exe	dwm.exe
PID 4304 wrote to memory of 400	4304	svchost.exe	dwm.exe
PID 4304 wrote to memory of 392	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 392	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 392	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 392	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 392	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 392	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 696	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 696	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 696	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 696	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 696	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 696	4304	svchost.exe	svchost.exe
PID 4304 wrote to memory of 964	4304	svchost.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:804

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3456

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
2⤵
PID:3544

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3688

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
2⤵
PID:3392

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3304

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3812

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:4088

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
2⤵
PID:3380

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:692

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1064

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2080

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:676

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RAMN.vbs"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3100

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 488
4⤵
- Program crash
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:3804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:5060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4796

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2072

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4304 -ip 4304
1⤵
PID:460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
df455f0fa8fb3fa4e6699ad57ef54db6

SHA1
51a06248c251d614d3a81ac9d842ba807204d17c

SHA256
15068b86edc0473a4f96f109830318e0540af348197e2b65f2e90ff32cfb14a1

SHA512
f69dea5b68e4fc8737fc0e6ef48476d3ed0a5ebd2f9dccc9d966df137f9ffdbb51e413a0852c22399afab53ea8a2755664afdcee6897a1cf387a9a620481b2a6

Download Submit
memory/4304-134-0x0000000077CB0000-0x0000000077E53000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads