1872a080e41bf4ed1f00782501b583d130740cd97329cd554765f4513a7c31d2

Analysis

max time kernel
120s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
18-04-2022 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

?????????? ? ?????? ????? ???????? ?????-?????????.jse
Size

5KB
MD5

d330aad3bfd86656f6f3c9271ebefe27
SHA1

442892ac4dc64348d009b8f7d1f8cb2d3522340b
SHA256

1b89fbda3bb65e0f5c2f9aa178082d418393087f37f0a1cd3f68645eec4a834f
SHA512

c869200fe3fcadeda670f78ab5ed327e7672d4b22b9ecdf6089c8aea9493b3f20e474f22a53a586cccdcc51cfe187dce08f38222bc6dc7621696175119bcdf9d

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	864	WScript.exe
8	864	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3336	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 3880	864	WScript.exe	79
PID 864 wrote to memory of 3880	864	WScript.exe	79

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\__________ _ ______ _____ ________ _____-_________.jse"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\rad558C5.tmp
  2⤵
  - Modifies registry class
  PID:3880

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rad558C5.tmp

Filesize
21KB

MD5
0b663466e06e88d3c558a232e780f387

SHA1
b68e007b091700f0d3049a15f99960b49d3599ca

SHA256
32ab85d95e588fd66580b8c9387be60ee7f30960889f296b0e4a8bc26b71418f

SHA512
35c55d76caba0cad207ffc3b9239b6af07955d748f4add0a74afd82cb5fb652f55067eabbd3a1ec52a295ec60a0d7fd49de15ba40ea2d9981623030ae844d568

Download Submit