b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe

General

Target
b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe
Size 179KB
Sample220919-wl6crabef5
SHA256 b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe
MD5 70f49763891424578f12272541e1e32e
SHA1 61d3fa4ebd8591d904283c6d459ed02aea42dbeb
SHA512 9028c333c121d11f5ab060c54d75f49bc586fea8de36c3923873d6db8dffa29b9821a4dc9519f7b2fd5072a1481695c5e2f96bf35dfb56e541fda9246696d1b8
SSDEEP 3072:qBAp5XhKpN4eOyVTGfhEClj8jTk+0hgILG6sH/Cbcj:5bXE9OiTGfhEClq9cLGBH/CA
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	4924	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\LTD-KIDS\LTDS\zizn_eto_gagarinl.vbs	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe
File opened for modification	C:\Program Files (x86)\LTD-KIDS\LTDS\skalanko_poligon.vbs	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe
File opened for modification	C:\Program Files (x86)\LTD-KIDS\LTDS\papko.txt	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe
File opened for modification	C:\Program Files (x86)\LTD-KIDS\LTDS\molsoko.bat	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4964	4720	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe	79
PID 4720 wrote to memory of 4964	4720	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe	79
PID 4720 wrote to memory of 4964	4720	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe	79
PID 4720 wrote to memory of 4924	4720	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe	81
PID 4720 wrote to memory of 4924	4720	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe	81
PID 4720 wrote to memory of 4924	4720	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe	81
PID 4720 wrote to memory of 1412	4720	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe	82
PID 4720 wrote to memory of 1412	4720	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe	82
PID 4720 wrote to memory of 1412	4720	b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe	82

C:\Users\Admin\AppData\Local\Temp\b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe
"C:\Users\Admin\AppData\Local\Temp\b1b959165278722b3ca7327c4c6e3b99743b66468f086638d3012f23286cfabe.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\LTD-KIDS\LTDS\molsoko.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:4964
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\LTD-KIDS\LTDS\zizn_eto_gagarinl.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:4924
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\LTD-KIDS\LTDS\skalanko_poligon.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:1412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

molsoko.bat

Path C:\Program Files (x86)\LTD-KIDS\LTDS\molsoko.bat
Size 2KB
SHA256 5817e41f95383055be7080642c884de7d8575819b74e4eca53aefd0b12f4fa2e
MD5 735f780bebe2df99af392041c89bb560
SHA1 4d0444f9779f89683f11a7ef75bf97f835162e07
SHA512 77ffee90ad7c61a0b1671e2687e950e29dbd928b5e5cebecb0a9d3bebc86f70ca8203ae9557e236946345627241b9482473f984f33b5ecf66acfcb502e07b6a5
MD5 SHA1 SHA512

Submit Download

papko.txt

Path C:\Program Files (x86)\LTD-KIDS\LTDS\papko.txt
Size 46B
SHA256 a1163f2b60204b4ec6115cb7c0a9e95acb025dd506c7a5e9a7f1b7b972c04ff4
MD5 deb01d772e96377ed5c4670adca2986a
SHA1 c02d0af6292b46aa6ed92f3814d558e100d18f7e
SHA512 3d0cc78107a10867ccb2814957e4c592b5e2ef366145c5f03d2ef2a4ff8df3d49125c29b26469ea6fa81e37c69bc16f8b07ff5bd1d4789ebcffa01ce06db4a87
MD5 SHA1 SHA512

Submit Download

skalanko_poligon.vbs

Path C:\Program Files (x86)\LTD-KIDS\LTDS\skalanko_poligon.vbs
Size 574B
SHA256 0b3d02a46e1823dce1612bc89cb602b98de82964ce1a9a2c66b4084313362ab7
MD5 9a8eaeeaa9afedb22c9d72bf7ee430cb
SHA1 59daf1a4ada66e9b47a2c9ec4bfec2d10ea2052b
SHA512 7dedfc60b9a6077385d0c9b47d9a53924d752eef48f49395013a0ab0a3de7015a102e01e308e40956dbef6b3377ee0fc0aa75fc413b0b4668b68a81122b4cd07
MD5 SHA1 SHA512

Submit Download

zizn_eto_gagarinl.vbs

Path C:\Program Files (x86)\LTD-KIDS\LTDS\zizn_eto_gagarinl.vbs
Size 400B
SHA256 c44bd1c64cda0506d0b15130186944a71da61c9bcef552546e1281c06f5b22b9
MD5 d2df7502cc668bc4422260209fdbba8e
SHA1 4acb5cbf6424c413366a0583df476c911fe10cd3
SHA512 1fb9c6715fa19a616f72bbe7ba4178d01670c898392be069f8dd2e280762748de86eea0195941cb57ccf064440583cf3129c06c5ff6da72d6f02a1c9a3cd81b7
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 898994545187173b645cf2e72b5540d87e2ca0b98f225c1192439579d96e1315
MD5 547bcbb3790875b927088dd60146e257
SHA1 734cf6d4829e9610e63cb43be15c6f7e915e327f
SHA512 d72c79aa906b7f93ab8a284cb80756da3291a0533f29517ce3121e33b4af75cb2e328061803c99266b5a3a8e883048be3dc0f8a0caaefa93280eb4e8ba64f3f8
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads