a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f

General

Target

a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
Size

128KB
MD5

10c5c61dc659699a16eda949f137df44
SHA1

817c5cae34d56161d860f80e33784a7a254fb854
SHA256

a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f
SHA512

09b7c3ec5ddd479910fc0750a8c050379d5e10cd7323785b6cbe507e1a3d0340b565ba1f80acb7a08765b4f052f1a50bfab75c364810b09e7fd0ea33eb1d687a
SSDEEP

3072:YBAp5XhKpN4eOyVTGfhEClj8jTk+0hMKBz61//:PbXE9OiTGfhEClq9FKxc/

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1116	WScript.exe
4	1116	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Fg\Kj\ssa.ki	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
File opened for modification	C:\Program Files (x86)\Fg\Kj\sra.chki	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
File opened for modification	C:\Program Files (x86)\Fg\Kj\767676767676767676767676767676767667aaa.bat	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
File opened for modification	C:\Program Files (x86)\Fg\Kj\separaro.vbs	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
File opened for modification	C:\Program Files (x86)\Fg\Kj\extravia.vbs	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1232	1380	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe	27
PID 1380 wrote to memory of 1232	1380	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe	27
PID 1380 wrote to memory of 1232	1380	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe	27
PID 1380 wrote to memory of 1232	1380	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe	27
PID 1232 wrote to memory of 1544	1232	cmd.exe	29
PID 1232 wrote to memory of 1544	1232	cmd.exe	29
PID 1232 wrote to memory of 1544	1232	cmd.exe	29
PID 1232 wrote to memory of 1544	1232	cmd.exe	29
PID 1232 wrote to memory of 1116	1232	cmd.exe	30
PID 1232 wrote to memory of 1116	1232	cmd.exe	30
PID 1232 wrote to memory of 1116	1232	cmd.exe	30
PID 1232 wrote to memory of 1116	1232	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
"C:\Users\Admin\AppData\Local\Temp\a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\Fg\Kj\767676767676767676767676767676767667aaa.bat" "
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Fg\Kj\separaro.vbs"
    3⤵
    - Drops file in Drivers directory
    PID:1544
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Fg\Kj\extravia.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Fg\Kj\767676767676767676767676767676767667aaa.bat

Filesize
1KB

MD5
81c374c12090f1a926f08e045cb4d292

SHA1
439d89e14b155642b0e20833602745f170260ff5

SHA256
27bae15472d92b9347f8434870f9d5c226de6225a2d15eedde70a5e42f6a4f03

SHA512
a9e46654910f05dfb25f10c7cafd3c4665a101e731bafa3da3bd6d4e35d71d3050f09111e48f001321e50d267d9c3d612d4c1d382a46aeaa1b3b293724518e0f

Download Submit
C:\Program Files (x86)\Fg\Kj\extravia.vbs

Filesize
136B

MD5
c4df678e50970d2083fc79fb120aa690

SHA1
9dd8a0873a77b667c0f6f79752b392f0bbecff7b

SHA256
5ffc4f3e65e52654be6aee729137e38c20efb1a4e2accb9dbace6e028f66eb44

SHA512
2413aaf65d84610942f192933de6af49f3cb781bfb67f4064ef5cba6ef054fdd43b326ffe42ed8a99f6146161c10934e7a6702e802f69b3137ffdaae62be53da

Download Submit
C:\Program Files (x86)\Fg\Kj\separaro.vbs

Filesize
1KB

MD5
5f6f2aabc5b477c36d13df08f6827b38

SHA1
f8c26b08b5a246fb765158b1d486a8ca31c82dd7

SHA256
bd7789e4423e974978cf78424d4809db99d7abf10c2151981c7c0e327d86a657

SHA512
54066604e59df69a68f7945bc08217875ae02d11128441fca458abdabd0d59bfa4c22e8de079720d79685f7baf6c228fb90d1bccf888784b8c4faf12b4463dce

Download Submit
C:\Program Files (x86)\Fg\Kj\sra.chki

Filesize
59B

MD5
aa32ab624b771f77bf31842baac23df1

SHA1
b5fdd843592b545acf6e13f978dcc4f86c0b733b

SHA256
b3db20253834aff456ef5511977fa2325ca8d072c01b37856d91d5e2a0f27f01

SHA512
d9f089bdebb9e543532539397b73f4ec9093e237a9cc380b5c6f313f70d584b99525b0095526a39cd2703e2c313567c3b96174b323aa3521a683b3efb935c19a

Download Submit
C:\Program Files (x86)\Fg\Kj\ssa.ki

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
408372136da2967e1d04df6c99b34fbe

SHA1
71409b28e971a26d7eb0b8454d19a6480775a3ab

SHA256
c27ea8c35bbc3bfd4e754c14f501d64d1ec5703089c79b8a590aa8efcd935859

SHA512
5cf02a271580f8ebed58594fa46f6f48daec64ba204926c3a0d9cad1b7ae96f81ba00c1d246e32b095603619c325f27ca1addf07e0514cde79fd6ce600312086

Download Submit
memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing