9396ba4ab7745281c804ab7ace895e93e8b7f662ae0c8fe177915b4295070e51

General

Target
gonnableed.bat
Size 8KB
Sample260730-mrcsyswbqg
SHA256 9396ba4ab7745281c804ab7ace895e93e8b7f662ae0c8fe177915b4295070e51
MD5 3a6a63aaa02bd2e007b3f6458c796f40
SHA1 e2ebbea7f02322db5150c261599218a9b4175379
SHA512 e20c194582647a900be34af009a789b7a7f5050cc87d95b2ce775f5a4984d94d803f13a44c0f93e2d61fa9de88853e1574989db88e159cc9b310c1f92942a16e
SSDEEP 96:kqbN390mfwfimxqlAyYswG7g/GJPWrXgnnnnn0EGXh40ULPNQZJNa8a/b76:dVXmxkwG0OJPWT0qJ0d/q
TLSH
T15412504872C68421F0BA4F52952D4D47FB1DE0EF93419C28348EC0E67F26B990ABB9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion execution ransomware

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4468	cscript.exe
4924	cscript.exe
6136	cscript.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\gonnableed.bat	cmd.exe
File created	C:\Windows\Logs\WindowsUpdate\gonnableed.bat	cmd.exe
File opened for modification	C:\Windows\Logs\WindowsUpdate\gonnableed.bat	cmd.exe
File created	C:\Windows\Microsoft\Windows	cmd.exe
File created	C:\Windows\Cursors\gonnableed.bat	cmd.exe
File opened for modification	C:\Windows\Cursors\gonnableed.bat	cmd.exe
File created	C:\Windows\gonnableed.bat	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6112	cmd.exe
4940	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1456	NOTEPAD.EXE

Runs net.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 2448	6112	cmd.exe	90
PID 2448 wrote to memory of 3136	2448	net.exe	91
PID 6112 wrote to memory of 4468	6112	cmd.exe	92
PID 6112 wrote to memory of 4924	6112	cmd.exe	93
PID 6112 wrote to memory of 1548	6112	cmd.exe	94
PID 6112 wrote to memory of 1456	6112	cmd.exe	95
PID 6112 wrote to memory of 4940	6112	cmd.exe	96
PID 4940 wrote to memory of 6136	4940	cmd.exe	97

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1548	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\gonnableed.bat"
1⤵
- Drops file in Windows directory
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3136
- C:\Windows\system32\cscript.exe
  CSCRIPT //nologo "C:\Users\Admin\AppData\Local\Temp\~tmpSendKeysTemp.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4468
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\popup.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4924
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\I_SEE_YOU"
  2⤵
  - Views/modifies file attributes
  PID:1548
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\myfile.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\pwbox.vbs"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\pwbox.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:6136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3924

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Visual Basic

1

T1059.005

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

myfile.txt

Path C:\Users\Admin\AppData\Local\Temp\myfile.txt
Size 348B
SHA256 fa76bb2b4dd9086e78a60891965f8e01768f789f285eb8e19468b176c35c7427
MD5 7b1b63653db846e4eab371ef87bc0533
SHA1 daf38c3b95679d0ffe7ec95a092aeaee7ab970c3
SHA512 762752cdf4d5de0ff0953c70707db8e1ea5a69078be28efb494e45bd1d5301bf3e36d570cd2d4133a8ae1f8721dc52c4d75231a0eee49185cb89d5859e573cb9
TLSH
T1D2E0C00FE60E228975312781F60E3E12FA2F402D42A11910281DC03C33239A2CAB217C
MD5 SHA1 SHA512 TLSH

Submit Download

popup.vbs

Path C:\Users\Admin\AppData\Local\Temp\popup.vbs
Size 205B
SHA256 852a7ecb37eb3e2e8984896096fe5a75e524ea4ddc948358def03134beea0e5e
MD5 9d073809ac93dafc64c7936c6c45e850
SHA1 d4b0c2187d62c021c5625eb26efd2669cddd8d98
SHA512 8a7cc16eade94bcd8bd2ef7555c3267f74fc4c6ff1a25caa0c47efdff23f0eecc32560aaf0a1759f3798d9a15672a41e2f6320da4980203908acf8f6aa9f0bca
TLSH
T159D022CFCF91F924D03902168E8463270723217A06120610F08EC00073B86BE3B71C38
MD5 SHA1 SHA512 TLSH

Submit Download

pwbox.vbs

Path C:\Users\Admin\AppData\Local\Temp\pwbox.vbs
Size 124B
SHA256 7effb7eb34ad9b17fa0ee306d2d545344b681a4aa0d55abd7900d7cf4ebc0d79
MD5 5b4a3b9bd26cb66fe601ec1378b6ca4b
SHA1 813e1ae50f52ba8d7a206cd27eefa9629d2a6856
SHA512 6361ee4e0e36d2c32b17b776a32640b954b01037625c9c4ac0df30ac810c3eb465ded909eda11096db22475ef4de9f0899a610fe956ec9372b4bf4de6a3a0580
TLSH
T10AB092193D0ACD961B0FD682A052400BBBE0DE73193388212338DB3C39BBD929B14187
MD5 SHA1 SHA512 TLSH

Submit Download

~tmpSendKeysTemp.vbs

Path C:\Users\Admin\AppData\Local\Temp\~tmpSendKeysTemp.vbs
Size 220B
SHA256 a74ed6dbbe51a7226b50a792a831b1c51b3fe6e3399dc7d4b65f032f3d9b565d
MD5 3dec10528f311221eb1158ff547bc0da
SHA1 8dd369995bbb0dd83a82f4c6c7382c1aa86badd8
SHA512 af7b08247cc979354ee3b753b716e45537b34427857ed81551442d374d06a6f62295628fdf75dba880b2a495a793a4b8f653a0a623f519fbb018c912f2b3d42b
TLSH
T163D09228AC4CD8A5E429C3DB0773E9CDCBDC4920B003CCE8764DC85823302844F2101F
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads