f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b

General

Target

f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe
Size

287KB
MD5

aae391f6e6b6b14856fbc3e20ee8ada2
SHA1

a4b587892c80c3d4709f1870b021ba8354e1e7e9
SHA256

f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b
SHA512

93db9140c00c4afd151071aa845f880e46da676637a778eb2f1e162c16e17fae57ac15eb4c1b4359dbdcc4a83b5646b48130f21061357b9764664cf32f13aa55
SSDEEP

6144:3/2UwgZOH3jxzEFykCWuJnYZL9y39S8neivDHhTF+lLoLm84:v2UtCFz1RY7ytS8eijhTF+UmD

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp

pid process

912 f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp

pid	process
912	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp

Loads dropped DLL 3 IoCs

Processes:

f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exef4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp

pid	process
948	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe
912	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp
912	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exef4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp

description	pid	process	target process
PID 948 wrote to memory of 912	948	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp
PID 948 wrote to memory of 912	948	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp
PID 948 wrote to memory of 912	948	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp
PID 948 wrote to memory of 912	948	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp
PID 948 wrote to memory of 912	948	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp
PID 948 wrote to memory of 912	948	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp
PID 948 wrote to memory of 912	948	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp
PID 912 wrote to memory of 572	912	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp	WScript.exe
PID 912 wrote to memory of 572	912	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp	WScript.exe
PID 912 wrote to memory of 572	912	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp	WScript.exe
PID 912 wrote to memory of 572	912	f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp	WScript.exe

C:\Users\Admin\AppData\Local\Temp\f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe
"C:\Users\Admin\AppData\Local\Temp\f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\is-D0VKC.tmp\f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp
"C:\Users\Admin\AppData\Local\Temp\is-D0VKC.tmp\f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp" /SL5="$70124,53248,53248,C:\Users\Admin\AppData\Local\Temp\f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\rasphone.vbs"
3⤵
PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\rasphone.vbs

Filesize
1KB

MD5
4d889d0ff194f07b11b0fbf32be7d243

SHA1
d5b9ed40fc14551e10ac2cbceaecbc096e51044f

SHA256
e16edb9ea81393ec3109529a0d8984e45d73fed50d6674de000d1292820a446d

SHA512
dec89165d16b823c0bc75fc7117f7c6042b7a0387dfbef73c1f3839e8d112bedf796312027313afa47f75229214d39ad2ee8994cd7f31517825dbb8cabd27af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D0VKC.tmp\f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp

Filesize
681KB

MD5
8e3e4508030c1ffdb0196309114eb841

SHA1
33656ec0c5b5ab8ce4ac566be0a95a96ec4ac40c

SHA256
6d9b3b086a0cd15c9fd32cf639c61e52d4d928d0112a7bb75e95f010e995dd2b

SHA512
6f16872abeb2de9ce3d881cf4b13778af03a305b068e99a8e59735bd4c13b5ad6f24a7aa44c2327cbfbb8351324ab85bb2157d719249fa29eb6f46061badffa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D0VKC.tmp\f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp

Filesize
681KB

MD5
8e3e4508030c1ffdb0196309114eb841

SHA1
33656ec0c5b5ab8ce4ac566be0a95a96ec4ac40c

SHA256
6d9b3b086a0cd15c9fd32cf639c61e52d4d928d0112a7bb75e95f010e995dd2b

SHA512
6f16872abeb2de9ce3d881cf4b13778af03a305b068e99a8e59735bd4c13b5ad6f24a7aa44c2327cbfbb8351324ab85bb2157d719249fa29eb6f46061badffa4

Download Submit
\Users\Admin\AppData\Local\Temp\is-0UVPE.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-0UVPE.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-D0VKC.tmp\f4e943e4f14d0559940f33b5601aa7d12f43032f811d9b13d1b1e9a6e001d21b.tmp

Filesize
681KB

MD5
8e3e4508030c1ffdb0196309114eb841

SHA1
33656ec0c5b5ab8ce4ac566be0a95a96ec4ac40c

SHA256
6d9b3b086a0cd15c9fd32cf639c61e52d4d928d0112a7bb75e95f010e995dd2b

SHA512
6f16872abeb2de9ce3d881cf4b13778af03a305b068e99a8e59735bd4c13b5ad6f24a7aa44c2327cbfbb8351324ab85bb2157d719249fa29eb6f46061badffa4

Download Submit
memory/572-64-0x0000000000000000-mapping.dmp

Download
memory/912-58-0x0000000000000000-mapping.dmp

Download
memory/948-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/948-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/948-65-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing