f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1

General

Target

f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
Size

4.5MB
MD5

fe9a45491e215a118d47a7e9d2ec0150
SHA1

c943abab28f86b51771ff69f9deebdb52748f601
SHA256

f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1
SHA512

dc97ed149dddde987206aa7b27baf097cd086354e67923f67acc113c12c98c7bed97551f17c352ac0771bc66e297e8e187c2d6087540238a0ebae6f24c9df12e

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\System\rfusclient.exe	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File opened for modification	C:\Program Files (x86)\System\rfusclient.exe	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File created	C:\Program Files (x86)\System\regedit.reg	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File created	C:\Program Files (x86)\System\vp8decoder.dll	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File opened for modification	C:\Program Files (x86)\System\vp8encoder.dll	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File opened for modification	C:\Program Files (x86)\System\regedit.reg	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File created	C:\Program Files (x86)\System\mailsend.exe	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File opened for modification	C:\Program Files (x86)\System\install.bat	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File created	C:\Program Files (x86)\System\__tmp_rar_sfx_access_check_30319593	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File created	C:\Program Files (x86)\System\vp8encoder.dll	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File opened for modification	C:\Program Files (x86)\System\rutserv.exe	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File opened for modification	C:\Program Files (x86)\System\vp8decoder.dll	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File created	C:\Program Files (x86)\System\rutserv.exe	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File opened for modification	C:\Program Files (x86)\System\install.vbs	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File opened for modification	C:\Program Files (x86)\System\mailsend.exe	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File created	C:\Program Files (x86)\System\install.bat	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File opened for modification	C:\Program Files (x86)\System	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
File created	C:\Program Files (x86)\System\install.vbs	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1660	1532	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe	94
PID 1532 wrote to memory of 1660	1532	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe	94
PID 1532 wrote to memory of 1660	1532	f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe	94
PID 1660 wrote to memory of 1512	1660	WScript.exe	100
PID 1660 wrote to memory of 1512	1660	WScript.exe	100
PID 1660 wrote to memory of 1512	1660	WScript.exe	100
PID 1512 wrote to memory of 5076	1512	cmd.exe	102
PID 1512 wrote to memory of 5076	1512	cmd.exe	102
PID 1512 wrote to memory of 5076	1512	cmd.exe	102

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
5076	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe
"C:\Users\Admin\AppData\Local\Temp\f2435506ae840503e8de6dc5b75d92390cf1c84eab6e1ea9b42f006fba7d0dc1.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\System\install.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Program Files (x86)\System" +H +S /S /D
      4⤵
      Views/modifies file attributes
      PID:5076