9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1

General

Target

9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
Size

179KB
MD5

79372dcbf9858b005729da221561b2aa
SHA1

a499819f0659340a5d9ea72d4aa3c2189908551a
SHA256

9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1
SHA512

baef407ec4dac0fa792932546bd762c5d9c3e360f281ce4014700115946ff04560c09499e72a1ce4fc28940cd86080ddf8fdb41a4bbc599e00e432a28949855b
SSDEEP

3072:ABAp5XhKpN4eOyVTGfhEClj8jTk+0hvXUDFY/2g3xrpr:3bXE9OiTGfhEClq9QUDF2

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
46	2332	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\1\2\sogazr.bat	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
File opened for modification	C:\Program Files (x86)\1\2\daet.vbs	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
File opened for modification	C:\Program Files (x86)\1\2\ekstaz.vbs	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
File opened for modification	C:\Program Files (x86)\1\2\kids.txt	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
File opened for modification	C:\Program Files (x86)\1\2\gam.txt	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3452	4128	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	83
PID 4128 wrote to memory of 3452	4128	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	83
PID 4128 wrote to memory of 3452	4128	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	83
PID 4128 wrote to memory of 2332	4128	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	85
PID 4128 wrote to memory of 2332	4128	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	85
PID 4128 wrote to memory of 2332	4128	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	85
PID 4128 wrote to memory of 3520	4128	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	86
PID 4128 wrote to memory of 3520	4128	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	86
PID 4128 wrote to memory of 3520	4128	9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe	86

C:\Users\Admin\AppData\Local\Temp\9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe
"C:\Users\Admin\AppData\Local\Temp\9c638729808a273a531380193c158fd7f04cb0f703128ba3453ef24c4f830ab1.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\1\2\sogazr.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:3452
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\1\2\daet.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:2332
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\1\2\ekstaz.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:3520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\1\2\daet.vbs

Filesize
547B

MD5
232aa0068739f14ea68404c1dcb71929

SHA1
c70a0711fd6b9f38260b1c6dcb43e97ca2ad06a7

SHA256
8530396ddc8187a992d6561d04cb8a1726acf9ec299452e5395ac3aefce8d95b

SHA512
67717519e6df96404468a0a4af3ff7b3af5c136b7715f5955b6ddebc4b7ffae8d1c679d782511843e694336c2e6ec62e1a55af99d64c46adec20f777caca9d23

Download Submit
C:\Program Files (x86)\1\2\ekstaz.vbs

Filesize
588B

MD5
89031d9b74652f0be426774267586b8d

SHA1
7fd55000c315bcbd55ff51ed7b0ca201e978a8dc

SHA256
b50e00e042f97ad4e848444c9b2281e9dbb03dec367b53fcbe376e54c1e8fd4b

SHA512
fa0f2b5d94a14934c5ff100ef90c8a4af8686abeb4b67f02fc15d25f5181ec705b2182e22ed88be8647e5d87e5467db5f6a4d04d71edb55ff167a64e9cd5f40f

Download Submit
C:\Program Files (x86)\1\2\gam.txt

Filesize
1B

MD5
fc1262746424402278e88f6c1f02f581

SHA1
77ac341feebeb7c0a7ff8f9c6540531500693bac

SHA256
94455e3ed9f716bea425ef99b51fae47128769a1a0cd04244221e4e14631ab83

SHA512
f9cd8ac2f900da287babe09ec5a017506809531fa60d273a75eb2d5c7d9ad2d7596b4deb3dfd01638295e06a572c306fc0014dd36def8aa6c72de426a9bacff6

Download Submit
C:\Program Files (x86)\1\2\kids.txt

Filesize
5B

MD5
8249407cf0da9a987b8d09ce7f4d2979

SHA1
73c63d88a3fc1f87e6c66e437b458c1826efca8e

SHA256
d9caa2357f1ea7b8b1d10caf71f96e52e19b7446f017eea5f197710b650938a2

SHA512
f6d066137a051bee999489167da6f31d5a71ef0a127f286f8aebb2a9cc9f2437a06b37e5e5b671bd0344fbec45c79c6b8ddb2b1ab797a9a08bbb017d00fd6d26

Download Submit
C:\Program Files (x86)\1\2\sogazr.bat

Filesize
3KB

MD5
eadc34423f9258a670719eb7e2897f6a

SHA1
8a3a364c70fb77148c345a709f62dece838900e0

SHA256
033ace201e06b89a6689dd64f61afb047fbdf1bf10d0d96b8a2bc2de9ae77560

SHA512
bf2981bab0604962e235dbad6422b7d779bdf63e1578ba2a61f9f894c0a72725e809d6b1d1364642b6d4411c7183711bfad1a6a9efb86e014f5d692d3df20b9e

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
43d6665309616ca3f6113e06150a8ea6

SHA1
7d03ffdfcbd8e2cbc93b570e4458a5805ab3d7f1

SHA256
febd4744a28c35d65073acd9b18bccf9946fb8e0b5f3c29238dcebf569e7c656

SHA512
71faaca6cb6961ee62e6a76bed8217eb4867a440aad1bf05520d03d7be17dcd3058cdf4b0d38fc8c3a354a54251a31020ce806ebb0af611378c8ac81b5c7d00d

Download Submit

Analysis

Sharing