Analysis
-
max time kernel
174s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 18:20
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY NO- 2744.js
Resource
win7-20220414-en
General
-
Target
INQUIRY NO- 2744.js
-
Size
2.1MB
-
MD5
2f3507015138a0ef0d3c91fca1fcf5f2
-
SHA1
7cf3028b2f73ee9a7474b242721fbf9d1639e6c8
-
SHA256
bde745851b6cfd0b1f52692ff12873484fc0553f0a4c22976a71404991557655
-
SHA512
62c2ad91c890f7763063625f8f4dcee4f4eb845de9bd9ea9a65988d9915e55095c77c492848ecd66567c17ddc0d5bada37edc05a89dc0fc6fb1f76568f75aa68
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
mqrJgpkqFQIDTGK.exefilename.exefilename.exepid process 3832 mqrJgpkqFQIDTGK.exe 400 filename.exe 1920 filename.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exemqrJgpkqFQIDTGK.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation mqrJgpkqFQIDTGK.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
filename.exeWScript.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsvc.exe" filename.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry Key Name = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder\\filename.vbs -LL" WScript.exe -
Processes:
filename.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA filename.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
filename.exedescription pid process target process PID 400 set thread context of 1920 400 filename.exe filename.exe -
Drops file in Program Files directory 2 IoCs
Processes:
filename.exedescription ioc process File created C:\Program Files (x86)\TCP Service\tcpsvc.exe filename.exe File opened for modification C:\Program Files (x86)\TCP Service\tcpsvc.exe filename.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
mqrJgpkqFQIDTGK.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings mqrJgpkqFQIDTGK.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
filename.exepid process 1920 filename.exe 1920 filename.exe 1920 filename.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
filename.exepid process 1920 filename.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
filename.exedescription pid process Token: SeDebugPrivilege 1920 filename.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mqrJgpkqFQIDTGK.exefilename.exepid process 3832 mqrJgpkqFQIDTGK.exe 400 filename.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
wscript.exemqrJgpkqFQIDTGK.exefilename.exedescription pid process target process PID 2536 wrote to memory of 3832 2536 wscript.exe mqrJgpkqFQIDTGK.exe PID 2536 wrote to memory of 3832 2536 wscript.exe mqrJgpkqFQIDTGK.exe PID 2536 wrote to memory of 3832 2536 wscript.exe mqrJgpkqFQIDTGK.exe PID 3832 wrote to memory of 4224 3832 mqrJgpkqFQIDTGK.exe WScript.exe PID 3832 wrote to memory of 4224 3832 mqrJgpkqFQIDTGK.exe WScript.exe PID 3832 wrote to memory of 4224 3832 mqrJgpkqFQIDTGK.exe WScript.exe PID 3832 wrote to memory of 400 3832 mqrJgpkqFQIDTGK.exe filename.exe PID 3832 wrote to memory of 400 3832 mqrJgpkqFQIDTGK.exe filename.exe PID 3832 wrote to memory of 400 3832 mqrJgpkqFQIDTGK.exe filename.exe PID 400 wrote to memory of 1920 400 filename.exe filename.exe PID 400 wrote to memory of 1920 400 filename.exe filename.exe PID 400 wrote to memory of 1920 400 filename.exe filename.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\INQUIRY NO- 2744.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mqrJgpkqFQIDTGK.exe"C:\Users\Admin\AppData\Local\Temp\mqrJgpkqFQIDTGK.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\subfolder\filename.vbs"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe"C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exeC:\Users\Admin\AppData\Local\Temp\subfolder\filename.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\mqrJgpkqFQIDTGK.exeFilesize
1.5MB
MD578d03f710ce3b6b685466910ef2b5de6
SHA1705a31cfaa14a4390ae7609ca62b86f7d29999a1
SHA25625aa79b4a1ba3a3b6a411a76cfb839fc3d72324c690445b1b6dcbdb1240f9c4f
SHA512cc089a3b76e5bd41ad88e629230b523c1c0a05163a4a8428f1690992310c02b91b69bc0f0bf1980415750758d0810c5d20683d17b24523468b9ab67ab949f5a5
-
C:\Users\Admin\AppData\Local\Temp\mqrJgpkqFQIDTGK.exeFilesize
1.5MB
MD578d03f710ce3b6b685466910ef2b5de6
SHA1705a31cfaa14a4390ae7609ca62b86f7d29999a1
SHA25625aa79b4a1ba3a3b6a411a76cfb839fc3d72324c690445b1b6dcbdb1240f9c4f
SHA512cc089a3b76e5bd41ad88e629230b523c1c0a05163a4a8428f1690992310c02b91b69bc0f0bf1980415750758d0810c5d20683d17b24523468b9ab67ab949f5a5
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exeFilesize
1.5MB
MD578d03f710ce3b6b685466910ef2b5de6
SHA1705a31cfaa14a4390ae7609ca62b86f7d29999a1
SHA25625aa79b4a1ba3a3b6a411a76cfb839fc3d72324c690445b1b6dcbdb1240f9c4f
SHA512cc089a3b76e5bd41ad88e629230b523c1c0a05163a4a8428f1690992310c02b91b69bc0f0bf1980415750758d0810c5d20683d17b24523468b9ab67ab949f5a5
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exeFilesize
1.5MB
MD578d03f710ce3b6b685466910ef2b5de6
SHA1705a31cfaa14a4390ae7609ca62b86f7d29999a1
SHA25625aa79b4a1ba3a3b6a411a76cfb839fc3d72324c690445b1b6dcbdb1240f9c4f
SHA512cc089a3b76e5bd41ad88e629230b523c1c0a05163a4a8428f1690992310c02b91b69bc0f0bf1980415750758d0810c5d20683d17b24523468b9ab67ab949f5a5
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.exeFilesize
1.5MB
MD578d03f710ce3b6b685466910ef2b5de6
SHA1705a31cfaa14a4390ae7609ca62b86f7d29999a1
SHA25625aa79b4a1ba3a3b6a411a76cfb839fc3d72324c690445b1b6dcbdb1240f9c4f
SHA512cc089a3b76e5bd41ad88e629230b523c1c0a05163a4a8428f1690992310c02b91b69bc0f0bf1980415750758d0810c5d20683d17b24523468b9ab67ab949f5a5
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filename.vbsFilesize
1024B
MD5027c384fe2dc14fabe3c2ecd2b85043b
SHA13a066fb1a971f2a9a9ebe38f9332e5180cad1a3d
SHA2566fa7a9e80bc9b9e3c1481628553c2bc6fec478eec7531f533b9bdbebab18a62c
SHA51218598a07f58c79cc93d4fdaab6745923138e98896cef570b5cf24c36da0deba0cdaedc12141d3d69c7953f100ee71a885945194cfd7f3b047ab6360450486b55
-
memory/400-139-0x0000000000000000-mapping.dmp
-
memory/400-147-0x00000000774D0000-0x0000000077673000-memory.dmpFilesize
1.6MB
-
memory/1920-149-0x0000000000400000-0x0000000000576000-memory.dmpFilesize
1.5MB
-
memory/1920-151-0x0000000074B40000-0x00000000750F1000-memory.dmpFilesize
5.7MB
-
memory/1920-152-0x00000000774D0000-0x0000000077673000-memory.dmpFilesize
1.6MB
-
memory/1920-150-0x00000000774D0000-0x0000000077673000-memory.dmpFilesize
1.6MB
-
memory/1920-145-0x0000000000000000-mapping.dmp
-
memory/1920-153-0x0000000074B40000-0x00000000750F1000-memory.dmpFilesize
5.7MB
-
memory/1920-148-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3832-142-0x00000000774D0000-0x0000000077673000-memory.dmpFilesize
1.6MB
-
memory/3832-130-0x0000000000000000-mapping.dmp
-
memory/3832-136-0x00000000774D0000-0x0000000077673000-memory.dmpFilesize
1.6MB
-
memory/3832-135-0x0000000002A90000-0x0000000002A97000-memory.dmpFilesize
28KB
-
memory/4224-137-0x0000000000000000-mapping.dmp