d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba

General

Target

d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
Size

239KB
MD5

0ead0adc664e5f7c6faff13b3d063e13
SHA1

b171249e542a53dcd3295cd8b5ebc0a6273c470a
SHA256

d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba
SHA512

a38a4df53475edd71c70651bd4c9d1c04029584f658a665fefb6cef4f7284a94cae8ccdddd9607ade812e90dbea952e0ee42e35d9ab91c32e519c2434c204051
SSDEEP

3072:+BAp5XhKpN4eOyVTGfhEClj8jTk+0heklmPpN+Cgw5CKHq:VbXE9OiTGfhEClq9Fk7JJUq

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	4880	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\lethala fell blowsinisterby somefell.chanc	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.exe	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.ini	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\lethala fell blowsinisterby somefell.chanc	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.exe	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs	cmd.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 796	4100	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe	79
PID 4100 wrote to memory of 796	4100	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe	79
PID 4100 wrote to memory of 796	4100	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe	79
PID 4100 wrote to memory of 4880	4100	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe	81
PID 4100 wrote to memory of 4880	4100	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe	81
PID 4100 wrote to memory of 4880	4100	d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe	81

C:\Users\Admin\AppData\Local\Temp\d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe
"C:\Users\Admin\AppData\Local\Temp\d775e38979ea9ac29bab8b741f404ee3f0250303271f7716928b3d4387a464ba.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:796
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:4880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking

Filesize
1KB

MD5
b1d81d8267e7d0333ec477248bcf369c

SHA1
5ab5d3d7566d12c2048edd07818b491aec473e05

SHA256
0abe58bcbfd6a137bca3b63db723dd29ff5eeeef4d9303ee00496d7a01239259

SHA512
91080b33b4602bb28bed4d748de0bac3f174a436d033a36bd6ae4e3f8f5ef105b71b5e8a9fa63226d57a555894dc581082db9baf6c266126658cb48ddd4ee161

Download Submit
C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs

Filesize
1KB

MD5
b1d81d8267e7d0333ec477248bcf369c

SHA1
5ab5d3d7566d12c2048edd07818b491aec473e05

SHA256
0abe58bcbfd6a137bca3b63db723dd29ff5eeeef4d9303ee00496d7a01239259

SHA512
91080b33b4602bb28bed4d748de0bac3f174a436d033a36bd6ae4e3f8f5ef105b71b5e8a9fa63226d57a555894dc581082db9baf6c266126658cb48ddd4ee161

Download Submit
C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol

Filesize
112B

MD5
ced15b19793f660bd4a245291cadfdcb

SHA1
d3308603b5d4827139b03b9afe5d125c90b22aee

SHA256
ea3fc644ab9385ff178295c4d3e201f409114a76d3c5d5117a7509a5f744dbf9

SHA512
8234f236e4ebc08815f1ac13b44fae0bddeaced372b2d4b3990431b8f90e3742d721c2c31d5dfa821c03acdb38ed4634d48a0d677b0ade304bcbd90bf6229e46

Download Submit
C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat

Filesize
1KB

MD5
c81ccd122d68286b87f661117227c1fc

SHA1
23ff4e0504b3d490f3e4f2c5ed4b106be1fd8839

SHA256
7f8a04aa1f3a1a7002392299b37508bc53d9ddb6ba7affdc1530c3a7b7a9c87f

SHA512
dc1d5404223e95cb0dfee0345cdc6bf353b067e29107408003fa085d64c47035902f43f9d8f97539b7fc611e21ff491ab3ea1ebad914ca03c0cca81a0f0b9315

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
cb007436bcbee4e2cf4d65acf7b5cc28

SHA1
40c881da47c7a77a3a73742ad3b433ef70488987

SHA256
89db2887fd15dd21ffedcd164e88beb4f62c91d876b6c7ed8044af00b53abbbc

SHA512
70f3911f673c0ca6c40f88b561d72c5c9d431ab0a364316f6030b7e55f740f3c61120c841e11f5ab2a7e66250492e8f95c861eb9eaf8d40beacda44144694c9c

Download Submit

Analysis

Sharing