509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e

General

Target

509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe
Size

180KB
MD5

46fd60c2ef667ad3fa9411eca51fb920
SHA1

40efd2cee6f43bc1ccd5cd0da672bdb8b9812f67
SHA256

509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e
SHA512

699e95cc40b179e5b949b0aa4442698949d08ee3e652c36ee8ca92ebae68b210f1e28791460a3f881c10e215128efce8ffe4daf198c0584f22281e0493579d35
SSDEEP

3072:SBAp5XhKpN4eOyVTGfhEClj8jTk+0hj9nPsyVGzRW:hbXE9OiTGfhEClq9cnUyVGg

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1584	WScript.exe
4	1584	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\primarily the African oil palm\Palm oil is an edible vegetable\palm\Elaeioleiferandhemar.ipa	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe
File opened for modification	C:\Program Files (x86)\primarily the African oil palm\Palm oil is an edible vegetable\palm\Crudepalmilutures.bat	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe
File opened for modification	C:\Program Files (x86)\primarily the African oil palm\Palm oil is an edible vegetable\palm\yellowishfattyilobtained.vbs	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe
File opened for modification	C:\Program Files (x86)\primarily the African oil palm\Palm oil is an edible vegetable\palm\conservationistsandother.vbs	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 908	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	28
PID 1652 wrote to memory of 908	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	28
PID 1652 wrote to memory of 908	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	28
PID 1652 wrote to memory of 908	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	28
PID 1652 wrote to memory of 1744	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	30
PID 1652 wrote to memory of 1744	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	30
PID 1652 wrote to memory of 1744	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	30
PID 1652 wrote to memory of 1744	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	30
PID 1652 wrote to memory of 1584	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	31
PID 1652 wrote to memory of 1584	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	31
PID 1652 wrote to memory of 1584	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	31
PID 1652 wrote to memory of 1584	1652	509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe	31

C:\Users\Admin\AppData\Local\Temp\509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe
"C:\Users\Admin\AppData\Local\Temp\509366d1b70f5fcf4a31327224714bd53d02d7bcbf3e7aefed5951a9fadd982e.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\primarily the African oil palm\Palm oil is an edible vegetable\palm\Crudepalmilutures.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:908
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\primarily the African oil palm\Palm oil is an edible vegetable\palm\yellowishfattyilobtained.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:1744
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\primarily the African oil palm\Palm oil is an edible vegetable\palm\conservationistsandother.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\primarily the African oil palm\Palm oil is an edible vegetable\palm\Crudepalmilutures.bat

Filesize
669B

MD5
a332c1e1638b905381123d6e231fbc19

SHA1
6d8c50017d24fb30f4eb88f9813339ccb91d89b8

SHA256
2a852d8883d9728f60a3c2a14b57cc0bf59c97bfcc1b2b3ffbe09e072be74cc1

SHA512
98e76dfc608683c27f8b2559d6b15357da365b931d49e3da542d4c04ce54e999fbef3152b60c4a76a5ab033ee8f3ae2b7660c0574a2e7387f77155f021602b2b

Download Submit
C:\Program Files (x86)\primarily the African oil palm\Palm oil is an edible vegetable\palm\Elaeioleiferandhemar.ipa

Filesize
73B

MD5
bc199f9179358d9c4d09e13f3f56f12e

SHA1
19efe96988f005583d710b7d2c511c75eccbbbdc

SHA256
2babff9064a1533548b9eb828aee7fb77a7a3f140b4424deaa8a2716ad4f8907

SHA512
bb8c328bcc31e871c98d1337a666bf93d7bc5279591c84c6874c6fc4aaf30f053502e7f327a5fab77efe1357b764e288930a93b106966972af0c38baebdf79f9

Download Submit
C:\Program Files (x86)\primarily the African oil palm\Palm oil is an edible vegetable\palm\conservationistsandother.vbs

Filesize
499B

MD5
aa50d947717fc8772441a29adea1fb23

SHA1
8ac9678e4024eab203ecc3bbeaaab90100b0814a

SHA256
2d3fbe09f36f606f882a901a1a2954bad3dca89fb37abf8b20652c82fc54d4d5

SHA512
bf2dedce91d0fe0fec879f63393ffb24b7f55cfcd51c76ee3cc0fc0c06870240a22ab4bd531b6ee9863a45e3fe1a8ccf15ce32492e7c4128fd79c508b06293a6

Download Submit
C:\Program Files (x86)\primarily the African oil palm\Palm oil is an edible vegetable\palm\yellowishfattyilobtained.vbs

Filesize
648B

MD5
982a2f099e7c4b8e4f8a114c078a3b18

SHA1
f571635b0c92a70bc210a515f2cd1ee8f31597e1

SHA256
26f66c8a26b404a9bbfd049e0d21ff2273538b82bb4719b940f5b0ee7e167c17

SHA512
70ea830f6a4d8503a4913b5340478835cabf30d877be29d7ce98f49d937a0d7c6ddb6d7917879ed6d8431ca07f3d994ca7f6057de67da335b0f938353f7bb7c7

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
40fe6ce2d75538adff1c5adf9ae80643

SHA1
8bbf8d6d9535585bf5e0d1ae0b7f883c224bf500

SHA256
357568bf987374745bdbd561d3082752aea2e9ca0dc48a308d2628c1c7d683a9

SHA512
5f6fdb71afbadd526dda1283cc4c797c7c7688e99c5af9a36793b06257faa265a87a0235f7114865b8fc651d3311075c13066e5ecbc78df9c9eb39c2842b22b2

Download Submit
memory/1652-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing