1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11

General

Target

1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
Size

171KB
MD5

5b30987914c5bbd8060b53dbf254afda
SHA1

5905696174a3889a38185b1e748b8a215b44d799
SHA256

1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11
SHA512

360b531d8716d1e1d90dbffec4366304750c508d7bf370e0ba1970ef037dcffb0ccbd5ce8b2928a592a07a44f096bc124c7519ce6afc57a2cee9ddee013d9e8b
SSDEEP

3072:jBAp5XhKpN4eOyVTGfhEClj8jTk+0havEK4lXM:ObXE9OiTGfhEClq9gKZ

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	1372	WScript.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\poo\smar\sk.txt	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
File opened for modification	C:\Program Files (x86)\poo\smar\pl.txt	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
File opened for modification	C:\Program Files (x86)\poo\smar\loi.bat	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
File opened for modification	C:\Program Files (x86)\poo\smar\p01.vbs	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
File opened for modification	C:\Program Files (x86)\poo\smar\p20.vbs	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 3276	4960	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	82
PID 4960 wrote to memory of 3276	4960	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	82
PID 4960 wrote to memory of 3276	4960	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	82
PID 4960 wrote to memory of 1372	4960	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	84
PID 4960 wrote to memory of 1372	4960	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	84
PID 4960 wrote to memory of 1372	4960	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	84
PID 4960 wrote to memory of 2068	4960	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	85
PID 4960 wrote to memory of 2068	4960	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	85
PID 4960 wrote to memory of 2068	4960	1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe	85

C:\Users\Admin\AppData\Local\Temp\1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe
"C:\Users\Admin\AppData\Local\Temp\1331f120e8a4348e4ac0d0018f08ffa240ac8be193c16caf65bdeef9e5bc5a11.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\poo\smar\loi.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:3276
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\poo\smar\p01.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:1372
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\poo\smar\p20.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:2068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\poo\smar\loi.bat

Filesize
3KB

MD5
366c8a701090b145d296bc9b1b85b209

SHA1
cda631e7ab2a0433be657b41c82f6bdbabc3e59b

SHA256
b2d01c6912ef6efec8c30de98acac56484facd05a9bdf8d107fd706f20479174

SHA512
79ce9e658e6715a36856432674e22b5b70f1f01dfebf9b8a53c4172b795e3e4831f7d3257c673fe7b182f89f7e37257d9b2ab927b8bd5c470f179cb7cfc6e3ee

Download Submit
C:\Program Files (x86)\poo\smar\p01.vbs

Filesize
475B

MD5
1ad76868f3abaf2c185af11885240030

SHA1
62628f8efe529049fcf058ae43ccf507c453de7c

SHA256
d87fb4ef3d68816f962a7b85e54a82f174dab9aded9943bbff65aefff51204f9

SHA512
af8d69bde0fb1a8c76de5087abaf20f77af33901ff665b2ba9c3c255592b70e045f57d45ec986573ef6897d59fc7e33a84abde0ab92c2c853c71f7cbe0beccca

Download Submit
C:\Program Files (x86)\poo\smar\p20.vbs

Filesize
707B

MD5
7f7c7dd93f1d1ccb362195d8d3826387

SHA1
b3800c615280b165a08517540883d18f51d8573f

SHA256
4f34610f56f1d968439548e8e8cae89c8fcd50f2b5780fd0f8ed3f2121943ff7

SHA512
9aff5e2cb772b7d0fd0b96b952b2d8ebcb9ef062f63ed487fadf4523f21406ff47bdaa0d7e223fcc53afea5f9e8f7d0ad4ec21a75d8547ea9be0a41df27cfa16

Download Submit
C:\Program Files (x86)\poo\smar\pl.txt

Filesize
1B

MD5
fc1262746424402278e88f6c1f02f581

SHA1
77ac341feebeb7c0a7ff8f9c6540531500693bac

SHA256
94455e3ed9f716bea425ef99b51fae47128769a1a0cd04244221e4e14631ab83

SHA512
f9cd8ac2f900da287babe09ec5a017506809531fa60d273a75eb2d5c7d9ad2d7596b4deb3dfd01638295e06a572c306fc0014dd36def8aa6c72de426a9bacff6

Download Submit
C:\Program Files (x86)\poo\smar\sk.txt

Filesize
5B

MD5
54cf174060515887896fcc44489efa4e

SHA1
6e9713ac165af4a63aba88acdbda265e78d3b94a

SHA256
96b00e269eb9f5cd380135ace16f8949e22fdc5c706cb60d3278fd32425239a8

SHA512
3325b7332cd8baddaec2fa56ff1aa5758f4ae3e2a675c865958243575a831525902b17839d819adb53afbc6abf5d892dcf17b5a4b7cc36ae84d60cc2aaf13091

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
cd0ffeeab94c7b9528248389c86c32b0

SHA1
de4531a01f06868526d8a7a524c470f2e4cd0a6b

SHA256
e95655abb6c00ee6449b3c495efc1b2edf05edbcd92f9c968499864dbdc949d4

SHA512
a7b3d9f21bd28652fee00e7da8f170d8eb7311c5ea08dc6e710560f0579a6a4c51ae03a3158b093540e562bf8f3baca8e7de2ecccb3c2728f8d780f72b8cceed

Download Submit

Analysis

Sharing