701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d

General

Target

701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe
Size

180KB
MD5

c05fdde4fbdb7bbad3447967e750e7ce
SHA1

1b808adaa0c972190f3608e1fba6abdb59e9f413
SHA256

701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d
SHA512

c938030c33bc73f315129a2e1291da21bc8111546874fa064531958d7ce96916ef5db55487fcd6e0c56d83d6b0e678438431054654f2e5c87b691626ca9f8813
SSDEEP

3072:TBAp5XhKpN4eOyVTGfhEClj8jTk+0hkf9FKaF/kWTMjX1:+bXE9OiTGfhEClq9Ff9kaFcWwjl

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1160	WScript.exe
5	1160	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\v storonu\E230\10\EcuadoryGalapagos.bat	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe
File opened for modification	C:\Program Files (x86)\v storonu\E230\ultar\Latesttraveladvicefor.vbs	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe
File opened for modification	C:\Program Files (x86)\v storonu\E230\ultar\Simplyenteryouremailaddress.vbs	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe
File opened for modification	C:\Program Files (x86)\v storonu\E230\ultar\moskaraskakokokoko.hiq	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1388	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	27
PID 1776 wrote to memory of 1388	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	27
PID 1776 wrote to memory of 1388	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	27
PID 1776 wrote to memory of 1388	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	27
PID 1776 wrote to memory of 1944	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	29
PID 1776 wrote to memory of 1944	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	29
PID 1776 wrote to memory of 1944	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	29
PID 1776 wrote to memory of 1944	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	29
PID 1776 wrote to memory of 1160	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	30
PID 1776 wrote to memory of 1160	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	30
PID 1776 wrote to memory of 1160	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	30
PID 1776 wrote to memory of 1160	1776	701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe	30

C:\Users\Admin\AppData\Local\Temp\701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe
"C:\Users\Admin\AppData\Local\Temp\701e458639253c594bfb40f2c696ad4f867bae6e5ee20c491474d3c53b31a55d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\v storonu\E230\10\EcuadoryGalapagos.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:1388
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\v storonu\E230\ultar\Latesttraveladvicefor.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:1944
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\v storonu\E230\ultar\Simplyenteryouremailaddress.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:1160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\v storonu\E230\10\EcuadoryGalapagos.bat

Filesize
2KB

MD5
116275a7370a923b698ac4e60b2cddcf

SHA1
6b0ffb665471c33a437b15a655e0794894f13fa9

SHA256
5878f2ff62214d3b2ab0f2144a88c5a470678117d0cd59c3f01f990a6cf35c21

SHA512
da379f508ca6f2e98b59d4660604ea70289e2a0238c1598a7aafae0b874b9f0225315131b4e8ad8f7327fcc0de13fbef9e15ed19788b4445d2397e76949bdb80

Download Submit
C:\Program Files (x86)\v storonu\E230\ultar\Latesttraveladvicefor.vbs

Filesize
852B

MD5
7e90b77996f74b48164e837bec84d4e3

SHA1
bc2238677838cd065a007c3eee399d82f84c7f84

SHA256
84d468987c74a66c80f2751d80110456042c07104f41194ad63774332f14159a

SHA512
6496ceadca51fc4647554f636a253f47bbc3b88eae6dd6ec0d3816bf502e0d8b0b7f24a097d1543dafc524360ce3c593ded6ac15de3e5ccdb1c9a8f3a00f9932

Download Submit
C:\Program Files (x86)\v storonu\E230\ultar\Simplyenteryouremailaddress.vbs

Filesize
523B

MD5
6f653204a2e823af27c770dd571a63e9

SHA1
5b948c3b2009c3197fc67e6dc6c8fa333a3c9a8b

SHA256
69e4b5ae44790cebc30936c5c179ead75ab6382e6a2a71fadb1c44d7b3bae37f

SHA512
1eadabcac1076f57704217ef4e6598893905254ea180df094617378817de235adf4aa53bd770116fb57df9e3be09abd189a14d9e59e0a08b27f1a5d3143d3dcb

Download Submit
C:\Program Files (x86)\v storonu\E230\ultar\moskaraskakokokoko.hiq

Filesize
58B

MD5
036c7341ee1c58bf6b5c0c99ca14f9b7

SHA1
0c79ba4f7d96b3cba499b7aa9626424ed6dce839

SHA256
7bcfc2f5c045cb378693af93164cf482b417851a0c6ea8596766baa4e2d5945b

SHA512
9f4a7102833c59837688462ff9895c08e57df2f7692c6c0e48cd51059d19fbfab6f0ab82016fca87136c930fec923882d528359ee3cbfda8552fa134b4f9d2e5

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
e2f3f400912a1b4487c87fd7fa6dca9b

SHA1
c61a85948d8de0bf31523894b8c6e40615eddad9

SHA256
410d93c4a4da7f8b1c7ba33472ea7a7ec2f08e2554ffc7c6c725b4efa84a5906

SHA512
3b1ef612f7aae2220580d780d3311b3e23fa5abc1709186fbf52866cb4f9af43fdfa402801e43d3f3a40d97245e9f82d06b505b59d2f8cf14816600fd5d985d0

Download Submit
memory/1776-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing