1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11

General

Target

1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
Size

171KB
MD5

5b30987914c5bbd8060b53dbf254afda
SHA1

5905696174a3889a38185b1e748b8a215b44d799
SHA256

1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11
SHA512

360b531d8716d1e1d90dbffec4366304750c508d7bf370e0ba1970ef037dcffb0ccbd5ce8b2928a592a07a44f096bc124c7519ce6afc57a2cee9ddee013d9e8b
SSDEEP

3072:jBAp5XhKpN4eOyVTGfhEClj8jTk+0havEK4lXM:ObXE9OiTGfhEClq9gKZ

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1360	WScript.exe
5	1360	WScript.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\poo\smar\sk.txt	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
File opened for modification	C:\Program Files (x86)\poo\smar\pl.txt	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
File opened for modification	C:\Program Files (x86)\poo\smar\loi.bat	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
File opened for modification	C:\Program Files (x86)\poo\smar\p01.vbs	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
File opened for modification	C:\Program Files (x86)\poo\smar\p20.vbs	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1780	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	28
PID 1976 wrote to memory of 1780	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	28
PID 1976 wrote to memory of 1780	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	28
PID 1976 wrote to memory of 1780	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	28
PID 1976 wrote to memory of 1360	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	30
PID 1976 wrote to memory of 1360	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	30
PID 1976 wrote to memory of 1360	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	30
PID 1976 wrote to memory of 1360	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	30
PID 1976 wrote to memory of 1364	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	31
PID 1976 wrote to memory of 1364	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	31
PID 1976 wrote to memory of 1364	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	31
PID 1976 wrote to memory of 1364	1976	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	31

C:\Users\Admin\AppData\Local\Temp\1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
"C:\Users\Admin\AppData\Local\Temp\1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\poo\smar\loi.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:1780
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\poo\smar\p01.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:1360
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\poo\smar\p20.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:1364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\poo\smar\loi.bat

Filesize
3KB

MD5
366c8a701090b145d296bc9b1b85b209

SHA1
cda631e7ab2a0433be657b41c82f6bdbabc3e59b

SHA256
b2d01c6912ef6efec8c30de98acac56484facd05a9bdf8d107fd706f20479174

SHA512
79ce9e658e6715a36856432674e22b5b70f1f01dfebf9b8a53c4172b795e3e4831f7d3257c673fe7b182f89f7e37257d9b2ab927b8bd5c470f179cb7cfc6e3ee

Download Submit
C:\Program Files (x86)\poo\smar\p01.vbs

Filesize
475B

MD5
1ad76868f3abaf2c185af11885240030

SHA1
62628f8efe529049fcf058ae43ccf507c453de7c

SHA256
d87fb4ef3d68816f962a7b85e54a82f174dab9aded9943bbff65aefff51204f9

SHA512
af8d69bde0fb1a8c76de5087abaf20f77af33901ff665b2ba9c3c255592b70e045f57d45ec986573ef6897d59fc7e33a84abde0ab92c2c853c71f7cbe0beccca

Download Submit
C:\Program Files (x86)\poo\smar\p20.vbs

Filesize
707B

MD5
7f7c7dd93f1d1ccb362195d8d3826387

SHA1
b3800c615280b165a08517540883d18f51d8573f

SHA256
4f34610f56f1d968439548e8e8cae89c8fcd50f2b5780fd0f8ed3f2121943ff7

SHA512
9aff5e2cb772b7d0fd0b96b952b2d8ebcb9ef062f63ed487fadf4523f21406ff47bdaa0d7e223fcc53afea5f9e8f7d0ad4ec21a75d8547ea9be0a41df27cfa16

Download Submit
C:\Program Files (x86)\poo\smar\pl.txt

Filesize
1B

MD5
fc1262746424402278e88f6c1f02f581

SHA1
77ac341feebeb7c0a7ff8f9c6540531500693bac

SHA256
94455e3ed9f716bea425ef99b51fae47128769a1a0cd04244221e4e14631ab83

SHA512
f9cd8ac2f900da287babe09ec5a017506809531fa60d273a75eb2d5c7d9ad2d7596b4deb3dfd01638295e06a572c306fc0014dd36def8aa6c72de426a9bacff6

Download Submit
C:\Program Files (x86)\poo\smar\sk.txt

Filesize
5B

MD5
54cf174060515887896fcc44489efa4e

SHA1
6e9713ac165af4a63aba88acdbda265e78d3b94a

SHA256
96b00e269eb9f5cd380135ace16f8949e22fdc5c706cb60d3278fd32425239a8

SHA512
3325b7332cd8baddaec2fa56ff1aa5758f4ae3e2a675c865958243575a831525902b17839d819adb53afbc6abf5d892dcf17b5a4b7cc36ae84d60cc2aaf13091

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
749a66810657e6a082ff2241be938b7e

SHA1
91551bf9557ead015290c649101b583a9d749a96

SHA256
fadab027dff5108f1e58dddf23512c6932f7b57d27364f0cdd5ed306935fc4f5

SHA512
0814a702364072ee2c959004e5ebe2421c7f55d4736d2ff3179f9e5f1ed7c515054a4e5bc9ae498573919a52c24b9ccf2ca979563746e5de51b306506ae2751e

Download Submit
memory/1976-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing