4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e

General

Target

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe
Size

2.1MB
MD5

087d6c8306538655e99a7cbc734152e6
SHA1

3f4499b01e23549ce5c2992ffaf098de9ed4cbc6
SHA256

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e
SHA512

60b8822d1cff7fb8b82484a50fb195148d9f0d11c5d5d14a9f01c5622a324ec433828087c32416037b0567d68527364d6795bb302575d6b5e739e027ea400b40

Score

8^/10

evasion upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

svchost.exesvchost.exesvchost.exesvchost.exe

pid process

852 svchost.exe
1900 svchost.exe
1604 svchost.exe
364 svchost.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
852	svchost.exe
1900	svchost.exe
1604	svchost.exe
364	svchost.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx

Deletes itself 1 IoCs

Processes:

WScript.exe

pid process

896 WScript.exe
Loads dropped DLL 1 IoCs

Processes:

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe

pid process

1844 4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe

pid	process
896	WScript.exe

Drops file in Windows directory 5 IoCs

Processes:

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exeattrib.exe

description	ioc	process
File opened for modification	\??\c:\windows\Fonts\conhost.exe	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe
File opened for modification	\??\c:\windows\Fonts\svchost.exe	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe
File created	\??\c:\windows\Fonts\svchost.exe	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File created	\??\c:\windows\Fonts\conhost.exe	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe

pid	process
1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe
1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.execmd.exe

description	pid	process	target process
PID 1844 wrote to memory of 1980	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	cmd.exe
PID 1844 wrote to memory of 1980	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	cmd.exe
PID 1844 wrote to memory of 1980	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	cmd.exe
PID 1844 wrote to memory of 1980	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	cmd.exe
PID 1844 wrote to memory of 2040	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 2040	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 2040	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 2040	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1504	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1504	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1504	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1504	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1732	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1732	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1732	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1732	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1492	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1492	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1492	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1492	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 840	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 840	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 840	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 840	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 584	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 584	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 584	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 584	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1980 wrote to memory of 1660	1980	cmd.exe	attrib.exe
PID 1980 wrote to memory of 1660	1980	cmd.exe	attrib.exe
PID 1980 wrote to memory of 1660	1980	cmd.exe	attrib.exe
PID 1980 wrote to memory of 1660	1980	cmd.exe	attrib.exe
PID 1844 wrote to memory of 1068	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1068	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1068	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1068	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1208	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1208	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1208	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1208	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1264	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1264	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1264	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1264	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1284	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1284	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1284	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 1284	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	net.exe
PID 1844 wrote to memory of 892	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 892	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 892	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 892	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	sc.exe
PID 1844 wrote to memory of 1900	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1844 wrote to memory of 1900	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1844 wrote to memory of 1900	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1844 wrote to memory of 1900	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1844 wrote to memory of 852	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1844 wrote to memory of 852	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1844 wrote to memory of 852	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1844 wrote to memory of 852	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1844 wrote to memory of 364	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1844 wrote to memory of 364	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1844 wrote to memory of 364	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe
PID 1844 wrote to memory of 364	1844	4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe	svchost.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1660 attrib.exe

pid	process
1660	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe
"C:\Users\Admin\AppData\Local\Temp\4b61679662313916b18999fbe63ea2d0163d2b3e6aad16e09aea27cbb97dac9e.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r -a %SystemRoot%\Fonts
2⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r -a C:\Windows\Fonts
3⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1660

C:\Windows\SysWOW64\net.exe
net stop MicrosotMaims
2⤵
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MicrosotMaims
3⤵
PID:1060

C:\Windows\SysWOW64\sc.exe
sc delete MicrosotMaims
2⤵
PID:1504

C:\Windows\SysWOW64\net.exe
net stop MicrosotMais
2⤵
PID:1732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MicrosotMais
3⤵
PID:1056

C:\Windows\SysWOW64\sc.exe
sc delete MicrosotMais
2⤵
PID:1492

C:\Windows\SysWOW64\net.exe
net stop lanmanserver /y
2⤵
PID:840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop lanmanserver /y
3⤵
PID:548

C:\Windows\SysWOW64\sc.exe
sc config lanmanserver start= DISABLED 2>nul
2⤵
PID:584

C:\Windows\SysWOW64\sc.exe
sc delete lanmanserver
2⤵
PID:1068

C:\Windows\SysWOW64\net.exe
net stop mssecsvc2.0
2⤵
PID:1208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mssecsvc2.0
3⤵
PID:1624

C:\Windows\SysWOW64\sc.exe
sc delete mssecsvc2.0
2⤵
PID:1264

C:\Windows\SysWOW64\net.exe
net stop mssecsvc2.1
2⤵
PID:1284

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mssecsvc2.1
3⤵
PID:912

C:\Windows\SysWOW64\sc.exe
sc delete mssecsvc2.1
2⤵
PID:892

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe install MicrosotMaims c:\windows\Fonts\conhost.exe
2⤵
- Executes dropped EXE
PID:1900

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe set MicrosotMaims DisplayName Network Location Service
2⤵
- Executes dropped EXE
PID:852

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe set MicrosotMaims Description Provides performance library information from Windows Management.
2⤵
- Executes dropped EXE
PID:364

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe start MicrosotMaims
2⤵
- Executes dropped EXE
PID:1604

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"
2⤵
- Deletes itself
PID:896

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Hidden Files and Directories

1

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tem.vbs
Filesize
275B

MD5
68416e79c8377392e4b42c88ee39e646

SHA1
6e5b53d68cd68887b8e79c30ae3250ad4de8c2fe

SHA256
369f620f0e615ecc9a2d9512f7e11593c0aafd00f40cbe044bf3300e7d60973b

SHA512
5399532b4463afa82b221cb745885ba0ace8f9287902914857ce949ae11c966fcdff41be407498a3a33b350a4b57bee0865e5e636335d54cf639540c77b259fc

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
C:\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
\Windows\Fonts\svchost.exe
Filesize
87KB

MD5
3215a773eecd1089babe6b9975086ebd

SHA1
6f28080e58149aeb72dfd0f2568ce80de4eff43c

SHA256
516319905545cf575de3322f7733d99d5293df4a38d46fccf1a41e23b64d2d6c

SHA512
664c519958fa80bb266764bf58543e9bd67665b540a78b9e7db4f25729c00fefbe5768a4fe75fa0b7905b19c9a02ba88b09e1eaef578593d5e97f450e22227ad

Download Submit
memory/364-72-0x0000000000000000-mapping.dmp

Download
memory/548-77-0x0000000000000000-mapping.dmp

Download
memory/584-61-0x0000000000000000-mapping.dmp

Download
memory/840-60-0x0000000000000000-mapping.dmp

Download
memory/852-70-0x0000000000000000-mapping.dmp

Download
memory/892-67-0x0000000000000000-mapping.dmp

Download
memory/896-82-0x0000000000000000-mapping.dmp

Download
memory/912-78-0x0000000000000000-mapping.dmp

Download
memory/1056-81-0x0000000000000000-mapping.dmp

Download
memory/1060-80-0x0000000000000000-mapping.dmp

Download
memory/1068-63-0x0000000000000000-mapping.dmp

Download
memory/1208-64-0x0000000000000000-mapping.dmp

Download
memory/1264-65-0x0000000000000000-mapping.dmp

Download
memory/1284-66-0x0000000000000000-mapping.dmp

Download
memory/1492-59-0x0000000000000000-mapping.dmp

Download
memory/1504-57-0x0000000000000000-mapping.dmp

Download
memory/1604-74-0x0000000000000000-mapping.dmp

Download
memory/1624-79-0x0000000000000000-mapping.dmp

Download
memory/1660-62-0x0000000000000000-mapping.dmp

Download
memory/1732-58-0x0000000000000000-mapping.dmp

Download
memory/1844-54-0x0000000075261000-0x0000000075263000-memory.dmp

Filesize
8KB

Download
memory/1900-69-0x0000000000000000-mapping.dmp

Download
memory/1980-55-0x0000000000000000-mapping.dmp

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads