39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8

General

Target

39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe
Size

479KB
MD5

0033775eeaddc98cdb766102431dd418
SHA1

02a6b365eb89b1430999d9ef1c275ad4ff5b7068
SHA256

39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8
SHA512

f223d0dca23c9cec72d2f479c8212981268379e95f3bcce42db8b346441428016997d1ceeaa66eafc65b9db3fa4c9ccd068049526af99372ed1f8664d72735cf

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 8 IoCs

Processes:

wscript.exe

flow pid process

3 1092 wscript.exe
4 1092 wscript.exe
5 1092 wscript.exe
6 1092 wscript.exe
7 1092 wscript.exe
8 1092 wscript.exe
9 1092 wscript.exe
10 1092 wscript.exe

flow	pid	process
3	1092	wscript.exe
4	1092	wscript.exe
5	1092	wscript.exe
6	1092	wscript.exe
7	1092	wscript.exe
8	1092	wscript.exe
9	1092	wscript.exe
10	1092	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.execmd.exe

description	pid	process	target process
PID 1636 wrote to memory of 1620	1636	39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe	cmd.exe
PID 1636 wrote to memory of 1620	1636	39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe	cmd.exe
PID 1636 wrote to memory of 1620	1636	39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe	cmd.exe
PID 1636 wrote to memory of 1620	1636	39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe	cmd.exe
PID 1636 wrote to memory of 1620	1636	39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe	cmd.exe
PID 1636 wrote to memory of 1620	1636	39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe	cmd.exe
PID 1636 wrote to memory of 1620	1636	39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe	cmd.exe
PID 1620 wrote to memory of 1092	1620	cmd.exe	wscript.exe
PID 1620 wrote to memory of 1092	1620	cmd.exe	wscript.exe
PID 1620 wrote to memory of 1092	1620	cmd.exe	wscript.exe
PID 1620 wrote to memory of 1092	1620	cmd.exe	wscript.exe
PID 1620 wrote to memory of 1092	1620	cmd.exe	wscript.exe
PID 1620 wrote to memory of 1092	1620	cmd.exe	wscript.exe
PID 1620 wrote to memory of 1092	1620	cmd.exe	wscript.exe

C:\Users\Admin\AppData\Local\Temp\39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe
"C:\Users\Admin\AppData\Local\Temp\39e312a1f6f2cf09306053aa615e35c8ebd0069ad68184f4a58a3171ec9baea8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\head.title.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\wscript.exe
    wscript /e:JScript "C:\Users\Admin\body"
    3⤵
    - Blocklisted process makes network request
    PID:1092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\body.css

Filesize
841KB

MD5
82f6bcbc72ab8520c6242798133d8c44

SHA1
10982f158d472b872ecfcdb666f123c084246a4a

SHA256
1ca593cd87e3a717627bc45c64f1598465bbb345f87b5e55f5b42353f2d54dbe

SHA512
ef2bace5ea92eb90fe10cecd274856a1d6db2417a20f98d1fa7273919a5c2b571f76b85fe2b0b358ebf8ee07832b78616cab6037a9c9638f4214cf3943123b68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\head.title.cmd

Filesize
336B

MD5
2dd6e037448138b092b6553e24806495

SHA1
4d48fc73183e2499ad8631c3eb2b99f2867581c2

SHA256
47ab47ff91a978ae2c69d7b10d0cf3ac5024c0a6f0748b83ed7fcb775b5866b6

SHA512
dc6224f155d0e232f7abb76ab67943729ddc23a9aa661a9c38e678956ce8b57e5ed1b6fed752ebd7e5dc7d971169a0626c502220bd297f30826ff3b264f40d76

Download Submit
C:\Users\Admin\body

Filesize
841KB

MD5
82f6bcbc72ab8520c6242798133d8c44

SHA1
10982f158d472b872ecfcdb666f123c084246a4a

SHA256
1ca593cd87e3a717627bc45c64f1598465bbb345f87b5e55f5b42353f2d54dbe

SHA512
ef2bace5ea92eb90fe10cecd274856a1d6db2417a20f98d1fa7273919a5c2b571f76b85fe2b0b358ebf8ee07832b78616cab6037a9c9638f4214cf3943123b68

Download Submit
memory/1092-59-0x0000000000000000-mapping.dmp

Download
memory/1620-55-0x0000000000000000-mapping.dmp

Download
memory/1636-54-0x00000000755A1000-0x00000000755A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing