36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2

General

Target

36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe
Size

180KB
MD5

65161b47a642f246616f25fa567165d0
SHA1

89fabbcd445dffcf602af83c671f3b36df533456
SHA256

36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2
SHA512

9f3b999f0bf97e73a0a5f199dbca712ddef84eb919f2b9c518841df2a89fd31f8f34ae08f6a5d04123df93d8067f0c867acc2274622abfe9e9a5a73ef4690212
SSDEEP

3072:hBAp5XhKpN4eOyVTGfhEClj8jTk+0hRGTSI/HSU:kbXE9OiTGfhEClq9r/HSU

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	4848	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\The first evidence\Guatemala\ee1\she.he	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe
File opened for modification	C:\Program Files (x86)\The first evidence\Guatemala\08a4415e9d594ff960030b921d42b91e.bat	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe
File opened for modification	C:\Program Files (x86)\The first evidence\Guatemala\ee1\63c4da4fde984fa5c719cdcf2147ab7f.vbs	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe
File opened for modification	C:\Program Files (x86)\The first evidence\Guatemala\ee1\87dba6b5e5e739d7a8506bbceb19e4be.vbs	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2976	1344	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	81
PID 1344 wrote to memory of 2976	1344	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	81
PID 1344 wrote to memory of 2976	1344	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	81
PID 1344 wrote to memory of 4848	1344	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	83
PID 1344 wrote to memory of 4848	1344	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	83
PID 1344 wrote to memory of 4848	1344	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	83
PID 1344 wrote to memory of 1296	1344	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	84
PID 1344 wrote to memory of 1296	1344	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	84
PID 1344 wrote to memory of 1296	1344	36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe	84

C:\Users\Admin\AppData\Local\Temp\36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe
"C:\Users\Admin\AppData\Local\Temp\36fe6fdbb91251473dbfbe80e6212ea78715cae17f691a9862d3371a9773e0d2.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\The first evidence\Guatemala\08a4415e9d594ff960030b921d42b91e.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:2976
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\The first evidence\Guatemala\ee1\63c4da4fde984fa5c719cdcf2147ab7f.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:4848
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\The first evidence\Guatemala\ee1\87dba6b5e5e739d7a8506bbceb19e4be.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\The first evidence\Guatemala\08a4415e9d594ff960030b921d42b91e.bat

Filesize
2KB

MD5
e7ddb9e86e8f813eacd8ffa139e15775

SHA1
c7ed4cf2e5b18de6a01f2805bde255641362d884

SHA256
0fc7195af221d2e1484396369582286450e717f67d791bafb5b9530193c99528

SHA512
428d7c47977052abc06b48009c5e96f31901702fa4e5444019ba40baf9c82014a37a4f81160e23e6dd86a8db1321327a81ad97fc52c6d205fc78220cd66b3220

Download Submit
C:\Program Files (x86)\The first evidence\Guatemala\ee1\63c4da4fde984fa5c719cdcf2147ab7f.vbs

Filesize
480B

MD5
0c8e671001c79460947228e68f851aec

SHA1
df41330fadad9582d9f1c6d59a369713c003c5b1

SHA256
7ced5d9d2d5c3232b54d664d3d9545f21232db9d9e81bd2862580359ff120776

SHA512
44d9ac1257bd026a4ca6992481eb5a3f0c86751d65c3fd4342949b49d7f71b3b90a16797a5263dc65bdd14e805c911fb843ab36e85b0187df883fd18a1f5e1e7

Download Submit
C:\Program Files (x86)\The first evidence\Guatemala\ee1\87dba6b5e5e739d7a8506bbceb19e4be.vbs

Filesize
636B

MD5
9681569860a9265e9b466bacb4867d31

SHA1
de7a643b14ed82bb02d756fb4cfcc68c13b4ad28

SHA256
6e0aa12bab90f05ff9eafbf2072397a42050086b62922de255e76c04841598c7

SHA512
7e9cd08dbe7847166a6078ce72e6f4fddee226319897904db32b375894329715c27aab4cee7b99ec987231c47475f3ff914ea3dd0818ee21654497e1cdf8a99f

Download Submit
C:\Program Files (x86)\The first evidence\Guatemala\ee1\she.he

Filesize
91B

MD5
813c8f8abb8d59ad8c796447e655d6d0

SHA1
538843d5139347af6894828e823581ec47220089

SHA256
7016c333c70f668e010cad62d27a3660eb6af3f2672e2579fbdc940e805e4690

SHA512
35ac2cffc4f38084390d921564127796a824eb6a1e97a2465ea400f9cc1024224f530ab25d83ae93f6d07c641ccb3b187d62930f69d8417feef937a39fec676a

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
984B

MD5
a4f6122771c7864d318dd7b2fc0d3854

SHA1
bf56d8b3de2632581938264a03b57e1f50bb015e

SHA256
ee8d2db023b81f53a7d46524f5dd69ec644ef282fc341b6b361cf2c040f36e24

SHA512
505708d786db4fb5ee3ac8b4b591d252ff1b69a741b08708aeea30e746e749e0cf708e6505c01787e84406505adb9da0685137ea54f4c5429fea99653eea8bc7

Download Submit

Analysis

Sharing