a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f

General

Target

a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
Size

128KB
MD5

10c5c61dc659699a16eda949f137df44
SHA1

817c5cae34d56161d860f80e33784a7a254fb854
SHA256

a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f
SHA512

09b7c3ec5ddd479910fc0750a8c050379d5e10cd7323785b6cbe507e1a3d0340b565ba1f80acb7a08765b4f052f1a50bfab75c364810b09e7fd0ea33eb1d687a
SSDEEP

3072:YBAp5XhKpN4eOyVTGfhEClj8jTk+0hMKBz61//:PbXE9OiTGfhEClq9FKxc/

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
10	4892	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Fg\Kj\767676767676767676767676767676767667aaa.bat	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
File opened for modification	C:\Program Files (x86)\Fg\Kj\separaro.vbs	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
File opened for modification	C:\Program Files (x86)\Fg\Kj\extravia.vbs	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
File opened for modification	C:\Program Files (x86)\Fg\Kj\ssa.ki	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
File opened for modification	C:\Program Files (x86)\Fg\Kj\sra.chki	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2324	5116	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe	81
PID 5116 wrote to memory of 2324	5116	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe	81
PID 5116 wrote to memory of 2324	5116	a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe	81
PID 2324 wrote to memory of 4920	2324	cmd.exe	84
PID 2324 wrote to memory of 4920	2324	cmd.exe	84
PID 2324 wrote to memory of 4920	2324	cmd.exe	84
PID 2324 wrote to memory of 4892	2324	cmd.exe	85
PID 2324 wrote to memory of 4892	2324	cmd.exe	85
PID 2324 wrote to memory of 4892	2324	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe
"C:\Users\Admin\AppData\Local\Temp\a26197ba89bd5aaa95338f438d9ca0b07bde791aa5eb85793100701874aa8d2f.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Fg\Kj\767676767676767676767676767676767667aaa.bat" "
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Fg\Kj\separaro.vbs"
    3⤵
    - Drops file in Drivers directory
    PID:4920
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Fg\Kj\extravia.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:4892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Fg\Kj\767676767676767676767676767676767667aaa.bat

Filesize
1KB

MD5
81c374c12090f1a926f08e045cb4d292

SHA1
439d89e14b155642b0e20833602745f170260ff5

SHA256
27bae15472d92b9347f8434870f9d5c226de6225a2d15eedde70a5e42f6a4f03

SHA512
a9e46654910f05dfb25f10c7cafd3c4665a101e731bafa3da3bd6d4e35d71d3050f09111e48f001321e50d267d9c3d612d4c1d382a46aeaa1b3b293724518e0f

Download Submit
C:\Program Files (x86)\Fg\Kj\extravia.vbs

Filesize
136B

MD5
c4df678e50970d2083fc79fb120aa690

SHA1
9dd8a0873a77b667c0f6f79752b392f0bbecff7b

SHA256
5ffc4f3e65e52654be6aee729137e38c20efb1a4e2accb9dbace6e028f66eb44

SHA512
2413aaf65d84610942f192933de6af49f3cb781bfb67f4064ef5cba6ef054fdd43b326ffe42ed8a99f6146161c10934e7a6702e802f69b3137ffdaae62be53da

Download Submit
C:\Program Files (x86)\Fg\Kj\separaro.vbs

Filesize
1KB

MD5
5f6f2aabc5b477c36d13df08f6827b38

SHA1
f8c26b08b5a246fb765158b1d486a8ca31c82dd7

SHA256
bd7789e4423e974978cf78424d4809db99d7abf10c2151981c7c0e327d86a657

SHA512
54066604e59df69a68f7945bc08217875ae02d11128441fca458abdabd0d59bfa4c22e8de079720d79685f7baf6c228fb90d1bccf888784b8c4faf12b4463dce

Download Submit
C:\Program Files (x86)\Fg\Kj\sra.chki

Filesize
59B

MD5
aa32ab624b771f77bf31842baac23df1

SHA1
b5fdd843592b545acf6e13f978dcc4f86c0b733b

SHA256
b3db20253834aff456ef5511977fa2325ca8d072c01b37856d91d5e2a0f27f01

SHA512
d9f089bdebb9e543532539397b73f4ec9093e237a9cc380b5c6f313f70d584b99525b0095526a39cd2703e2c313567c3b96174b323aa3521a683b3efb935c19a

Download Submit
C:\Program Files (x86)\Fg\Kj\ssa.ki

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
534dccdf285d41d5a34f0d7e3537cbd2

SHA1
3331a881b8d354e50ee3987412c0a9cd2f99883c

SHA256
9e5edd95354093d40ef271de4485ea8297e99214bfea8d33717d61c6517e4694

SHA512
a7b7771e0a1d9ec3bb1db6b27441de53a5d7f2942ec1334ab938479f44aef07147da35cde47aba91d0ef33372e81fd9597c982655fc4af1a8bd2c6df78235774

Download Submit
memory/2324-132-0x0000000000000000-mapping.dmp

Download
memory/4892-138-0x0000000000000000-mapping.dmp

Download
memory/4920-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing