2075279d423905585684a32d5383d3e6a340a048977b51cf3821e840a5138d65

General

Target

2075279d423905585684a32d5383d3e6a340a048977b51cf3821e840a5138d65.exe
Size

86KB
MD5

d0caf04a189058747f62fc8e2e83ea66
SHA1

9a64cadc760be3c3ba037590366c66ebb58b9cab
SHA256

2075279d423905585684a32d5383d3e6a340a048977b51cf3821e840a5138d65
SHA512

e5fc118be1c48d8278b7c5e3c4b0db82b82c8334389ce1f6ffbbe276773b90a1a3732c01945d9adce37b630064cd5d753c4dff57524e265a32678ffc1bf407a4
SSDEEP

1536:v/a62xrr5yYsHyO+l36ma9WUauHML5Zs1VaUgpqlIOKZJ5FOSRqFnouy8kO:p2xP5yVHIl36mZTuHM5+1YUgpqlIOih0

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2092-132-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/2092-137-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	cscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\teeplow.vbs	cscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\teeplow.vbs	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teeplow = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\teeplow.vbs\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\teeplow = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\teeplow.vbs\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\software\microsoft\windows\currentversion\run	cscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teeplow = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\teeplow.vbs\""	cscript.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	cscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\teeplow = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\teeplow.vbs\""	cscript.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\software\microsoft\windows\currentversion\run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 220	2092	2075279d423905585684a32d5383d3e6a340a048977b51cf3821e840a5138d65.exe	83
PID 2092 wrote to memory of 220	2092	2075279d423905585684a32d5383d3e6a340a048977b51cf3821e840a5138d65.exe	83
PID 2092 wrote to memory of 220	2092	2075279d423905585684a32d5383d3e6a340a048977b51cf3821e840a5138d65.exe	83
PID 220 wrote to memory of 3776	220	cscript.exe	84
PID 220 wrote to memory of 3776	220	cscript.exe	84
PID 220 wrote to memory of 3776	220	cscript.exe	84

C:\Users\Admin\AppData\Local\Temp\2075279d423905585684a32d5383d3e6a340a048977b51cf3821e840a5138d65.exe
"C:\Users\Admin\AppData\Local\Temp\2075279d423905585684a32d5383d3e6a340a048977b51cf3821e840a5138d65.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\cscript.exe
  "cscript" C:\Users\Admin\AppData\Local\Temp\470B.tmp\teeplow.vbs
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\teeplow.vbs"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    PID:3776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\470B.tmp\teeplow.vbs

Filesize
147KB

MD5
333ec0e5685b39b2701b48d94c8bfdf3

SHA1
bd7ed49596ef07b5a1ea1a15bb6880bc1d497429

SHA256
d803e0917631a847c18b12baa137b2c74c3348809cb38c82a2db95d8238ec754

SHA512
c8c00cc4020e47b7fd34fc28329644ba78e1c87e1be694d0a765df8f27da0e3ce93d100d92d731010d6d6001a9617704ea84b62abf78736ab0f10f47f8390697

Download Submit
C:\Users\Admin\AppData\Local\Temp\teeplow.vbs

Filesize
147KB

MD5
333ec0e5685b39b2701b48d94c8bfdf3

SHA1
bd7ed49596ef07b5a1ea1a15bb6880bc1d497429

SHA256
d803e0917631a847c18b12baa137b2c74c3348809cb38c82a2db95d8238ec754

SHA512
c8c00cc4020e47b7fd34fc28329644ba78e1c87e1be694d0a765df8f27da0e3ce93d100d92d731010d6d6001a9617704ea84b62abf78736ab0f10f47f8390697

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\teeplow.vbs

Filesize
147KB

MD5
333ec0e5685b39b2701b48d94c8bfdf3

SHA1
bd7ed49596ef07b5a1ea1a15bb6880bc1d497429

SHA256
d803e0917631a847c18b12baa137b2c74c3348809cb38c82a2db95d8238ec754

SHA512
c8c00cc4020e47b7fd34fc28329644ba78e1c87e1be694d0a765df8f27da0e3ce93d100d92d731010d6d6001a9617704ea84b62abf78736ab0f10f47f8390697

Download Submit
memory/2092-132-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2092-137-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing