killmbr | 615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1

General

Target
615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe
Size 84KB
Sample260712-2afwlsht7m
SHA256 615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1
MD5 f8b1e2d0b92311062cd2e1b5bec88e45
SHA1 53b1b3589b8acd715e96ab70f4405f7392092730
SHA512 8936621679326f1684a522dd1b09a3d8f4f5a17c4a13cb8f680718e16fb39d749c2e064cfd4b8915cb456123f14237e745aab88f98dd9a532cacc4e95bcac170
SSDEEP 1536:QVIn7vLAsry2eslLS8Ti1nQyd9O3jKVfOcHoHoPFXOvs/WP:QU/9+vstGGGFO0dXOv6WP
TLSH
T15C837C53B6C24372E68156B4419129B7EB31E73BC3625EC3C3045A07EF561F2CC7A2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution killmbr persistence ransomware trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4a6-193.dat	family_killmbr

Executes dropped EXE 1 IoCs

pid	Process
3212	MEMZ.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3496	cscript.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1076	3048	615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe	88
PID 1076 wrote to memory of 3496	1076	cmd.exe	89
PID 1076 wrote to memory of 3212	1076	cmd.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe
"C:\Users\Admin\AppData\Local\Temp\615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\DE07.tmp\DE17.bat C:\Users\Admin\AppData\Local\Temp\615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\system32\cscript.exe
    cscript x.js
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:3496
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DE17.bat

Path C:\Users\Admin\AppData\Local\Temp\DE07.tmp\DE17.bat
Size 13KB
SHA256 73b1516cf233953836bd4c5964d8246da55fc49d1ec2706405330e9fe108581c
MD5 1932aefc82bd14764a6bcd89efd882bc
SHA1 7267331b12d1094ff2ebc53a8370ecedc8eb7b19
SHA512 75904e3de919417da2174a31ac3f1054a5b27c739f469bd16fa6d7d9bdcd318fb17c8ff06c54119ae79d1b844ace3f723799576b278d2450a80eed0135b49fd0
SSDEEP 192:BOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllzYv:BVODaDSHMql3yqlxy5L1xcjwrlzC
TLSH
T151528E3236754E13193326CB5C3AA246BCF4503F361A5E71A4138DFB50AAFD1319EB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x

Path C:\Users\Admin\AppData\Local\Temp\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
TLSH
T1DB918EB6A5B89D076B4133F59D2B349F6CD4653B794592498810CCB904FFC0A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3048-0-0x0000000000412000-0x0000000000413000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads