84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a

General

Target

84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe
Size

596KB
MD5

060e1b6f31b6cdec27a6781f74afd817
SHA1

6b81a1ebc95d7bacd316583412fd01c15a52dc4b
SHA256

84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a
SHA512

761fcc303ff3386447cf32e58afba432959e5228e6722fb5ea7a6e42cb55d79f2ac1554f66cd5cb2ff61c41986e032995d463e2142d933af3932ea93496ff63b
SSDEEP

12288:7DYzYK7Q21AmY/AE+zUalJJF8HIQjqyPOIQriA4:/ZSz1AmsA/UHHI+cIQmt

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2800	svchst.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchst.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchst.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchst.exe	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe
File opened for modification	C:\Windows\svchst.exe	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1684	2800	WerFault.exe	81
3540	2800	WerFault.exe	81

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchst.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe
3444	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 1932	3444	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe	82
PID 3444 wrote to memory of 1932	3444	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe	82
PID 3444 wrote to memory of 1932	3444	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe	82
PID 2800 wrote to memory of 1684	2800	svchst.exe	92
PID 2800 wrote to memory of 1684	2800	svchst.exe	92
PID 2800 wrote to memory of 1684	2800	svchst.exe	92

C:\Users\Admin\AppData\Local\Temp\84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe
"C:\Users\Admin\AppData\Local\Temp\84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\9118.vbs"
  2⤵
  PID:1932

C:\Windows\svchst.exe
C:\Windows\svchst.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1412
  2⤵
  - Program crash
  PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1412
  2⤵
  - Program crash
  PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2800 -ip 2800
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\9118.vbs

Filesize
500B

MD5
1f6f7204fb8f69c25f0a8af19c1c50f0

SHA1
958e3713ee2c6d1fcf90b8f3f01a83ffddd36c6c

SHA256
4804d615d0252a09b32c59e89ab7298af4a0d84d6bc970239a0f4dc1871e2f3d

SHA512
99d80c204a45454c843e5235a9cbdaf3ace69a0aaa884b858facd828c64a7bd22c5901ad337f9de8a492c88500e573d979f9680b84841baab7c5da861ef8b57e

Download Submit
C:\Windows\svchst.exe

Filesize
596KB

MD5
060e1b6f31b6cdec27a6781f74afd817

SHA1
6b81a1ebc95d7bacd316583412fd01c15a52dc4b

SHA256
84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a

SHA512
761fcc303ff3386447cf32e58afba432959e5228e6722fb5ea7a6e42cb55d79f2ac1554f66cd5cb2ff61c41986e032995d463e2142d933af3932ea93496ff63b

Download Submit
C:\Windows\svchst.exe

Filesize
596KB

MD5
060e1b6f31b6cdec27a6781f74afd817

SHA1
6b81a1ebc95d7bacd316583412fd01c15a52dc4b

SHA256
84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a

SHA512
761fcc303ff3386447cf32e58afba432959e5228e6722fb5ea7a6e42cb55d79f2ac1554f66cd5cb2ff61c41986e032995d463e2142d933af3932ea93496ff63b

Download Submit

Analysis

Sharing