36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2

General

Target

36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe
Size

180KB
MD5

65161b47a642f246616f25fa567165d0
SHA1

89fabbcd445dffcf602af83c671f3b36df533456
SHA256

36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2
SHA512

9f3b999f0bf97e73a0a5f199dbca712ddef84eb919f2b9c518841df2a89fd31f8f34ae08f6a5d04123df93d8067f0c867acc2274622abfe9e9a5a73ef4690212
SSDEEP

3072:hBAp5XhKpN4eOyVTGfhEClj8jTk+0hRGTSI/HSU:kbXE9OiTGfhEClq9r/HSU

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1568	WScript.exe
5	1568	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\The first evidence\Guatemala\ee1\she.he	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe
File opened for modification	C:\Program Files (x86)\The first evidence\Guatemala\08a4415e9d594ff960030b921d42b91e.bat	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe
File opened for modification	C:\Program Files (x86)\The first evidence\Guatemala\ee1\63c4da4fde984fa5c719cdcf2147ab7f.vbs	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe
File opened for modification	C:\Program Files (x86)\The first evidence\Guatemala\ee1\87dba6b5e5e739d7a8506bbceb19e4be.vbs	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1820	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	28
PID 1572 wrote to memory of 1820	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	28
PID 1572 wrote to memory of 1820	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	28
PID 1572 wrote to memory of 1820	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	28
PID 1572 wrote to memory of 1568	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	30
PID 1572 wrote to memory of 1568	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	30
PID 1572 wrote to memory of 1568	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	30
PID 1572 wrote to memory of 1568	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	30
PID 1572 wrote to memory of 1648	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	31
PID 1572 wrote to memory of 1648	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	31
PID 1572 wrote to memory of 1648	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	31
PID 1572 wrote to memory of 1648	1572	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	31

C:\Users\Admin\AppData\Local\Temp\36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe
"C:\Users\Admin\AppData\Local\Temp\36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\The first evidence\Guatemala\08a4415e9d594ff960030b921d42b91e.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:1820
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\The first evidence\Guatemala\ee1\63c4da4fde984fa5c719cdcf2147ab7f.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:1568
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\The first evidence\Guatemala\ee1\87dba6b5e5e739d7a8506bbceb19e4be.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\The first evidence\Guatemala\08a4415e9d594ff960030b921d42b91e.bat

Filesize
2KB

MD5
e7ddb9e86e8f813eacd8ffa139e15775

SHA1
c7ed4cf2e5b18de6a01f2805bde255641362d884

SHA256
0fc7195af221d2e1484396369582286450e717f67d791bafb5b9530193c99528

SHA512
428d7c47977052abc06b48009c5e96f31901702fa4e5444019ba40baf9c82014a37a4f81160e23e6dd86a8db1321327a81ad97fc52c6d205fc78220cd66b3220

Download Submit
C:\Program Files (x86)\The first evidence\Guatemala\ee1\63c4da4fde984fa5c719cdcf2147ab7f.vbs

Filesize
480B

MD5
0c8e671001c79460947228e68f851aec

SHA1
df41330fadad9582d9f1c6d59a369713c003c5b1

SHA256
7ced5d9d2d5c3232b54d664d3d9545f21232db9d9e81bd2862580359ff120776

SHA512
44d9ac1257bd026a4ca6992481eb5a3f0c86751d65c3fd4342949b49d7f71b3b90a16797a5263dc65bdd14e805c911fb843ab36e85b0187df883fd18a1f5e1e7

Download Submit
C:\Program Files (x86)\The first evidence\Guatemala\ee1\87dba6b5e5e739d7a8506bbceb19e4be.vbs

Filesize
636B

MD5
9681569860a9265e9b466bacb4867d31

SHA1
de7a643b14ed82bb02d756fb4cfcc68c13b4ad28

SHA256
6e0aa12bab90f05ff9eafbf2072397a42050086b62922de255e76c04841598c7

SHA512
7e9cd08dbe7847166a6078ce72e6f4fddee226319897904db32b375894329715c27aab4cee7b99ec987231c47475f3ff914ea3dd0818ee21654497e1cdf8a99f

Download Submit
C:\Program Files (x86)\The first evidence\Guatemala\ee1\she.he

Filesize
91B

MD5
813c8f8abb8d59ad8c796447e655d6d0

SHA1
538843d5139347af6894828e823581ec47220089

SHA256
7016c333c70f668e010cad62d27a3660eb6af3f2672e2579fbdc940e805e4690

SHA512
35ac2cffc4f38084390d921564127796a824eb6a1e97a2465ea400f9cc1024224f530ab25d83ae93f6d07c641ccb3b187d62930f69d8417feef937a39fec676a

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
d036473a4b9cd60e4d8a355efe079337

SHA1
c2ec3e035ae4d163b452cd7ebd56a59e50122090

SHA256
f4f65643558da79f2598a634b3ccf2ef6635cc6db36268512584407593ffa932

SHA512
aab4e2e60c179c455ccd9cea3eda85a9ee6553b225bd26d3d5c70505ed59d76d9c8c191a2305c92a54e7e95923823087ebd426fffbb77684db0835a77207821b

Download Submit
memory/1572-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing