Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2022 03:11
Static task
static1
Behavioral task
behavioral1
Sample
Request QuotationPDF.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Request QuotationPDF.js
Resource
win10v2004-20220812-en
General
-
Target
Request QuotationPDF.js
-
Size
645KB
-
MD5
5f6d304b5cbeb4d90f819ddcd12cb53d
-
SHA1
81498fb959af13f0ca0c38d0c27c4c593168dac2
-
SHA256
8c47189a5400ade17afd5b97491d17c64a4cc0de8cd7a9191540218f9ebf0808
-
SHA512
a3de7a0d7cc72e704846801cc42d8b937ffccc0cdfa81d04fdd83e1a4cf9bd55ba3a4330a8d5cee429a2c3822005346648a2b77bcf1966c53af7d27bae86dbe5
-
SSDEEP
6144:TmO3RKX8lqCw+F02pnNNWxsRpYhirSpBfozHlvzEwB8yn6AljT5uLTXMj46tfZ4I:TmOzn0vYeDOLrn6Ap5uk4tSdL
Malware Config
Signatures
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Host Dns Alkaline.exe netwire C:\Users\Admin\AppData\Local\Temp\Host Dns Alkaline.exe netwire C:\Users\Admin\AppData\Roaming\Microsoft Woord\Words.exe netwire C:\Users\Admin\AppData\Roaming\Microsoft Woord\Words.exe netwire -
Executes dropped EXE 2 IoCs
Processes:
Host Dns Alkaline.exeWords.exepid process 4304 Host Dns Alkaline.exe 1848 Words.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exeHost Dns Alkaline.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Host Dns Alkaline.exe -
Drops startup file 1 IoCs
Processes:
Words.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Woord.lnk Words.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Words.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Words.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\§_ »R‰ƒ·àHYK‰ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Woord\\Words.exe" Words.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
wscript.exeHost Dns Alkaline.exeWords.execmd.exedescription pid process target process PID 920 wrote to memory of 4980 920 wscript.exe wscript.exe PID 920 wrote to memory of 4980 920 wscript.exe wscript.exe PID 920 wrote to memory of 4304 920 wscript.exe Host Dns Alkaline.exe PID 920 wrote to memory of 4304 920 wscript.exe Host Dns Alkaline.exe PID 920 wrote to memory of 4304 920 wscript.exe Host Dns Alkaline.exe PID 4304 wrote to memory of 1848 4304 Host Dns Alkaline.exe Words.exe PID 4304 wrote to memory of 1848 4304 Host Dns Alkaline.exe Words.exe PID 4304 wrote to memory of 1848 4304 Host Dns Alkaline.exe Words.exe PID 1848 wrote to memory of 3620 1848 Words.exe cmd.exe PID 1848 wrote to memory of 3620 1848 Words.exe cmd.exe PID 1848 wrote to memory of 3620 1848 Words.exe cmd.exe PID 3620 wrote to memory of 4512 3620 cmd.exe PING.EXE PID 3620 wrote to memory of 4512 3620 cmd.exe PING.EXE PID 3620 wrote to memory of 4512 3620 cmd.exe PING.EXE
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Request QuotationPDF.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\vDTKQNauyl.js"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Host Dns Alkaline.exe"C:\Users\Admin\AppData\Local\Temp\Host Dns Alkaline.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft Woord\Words.exe"C:\Users\Admin\AppData\Roaming\Microsoft Woord\Words.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\Microsoft Woord\Words.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Host Dns Alkaline.exeFilesize
227KB
MD5e8de62af8f6af96ec8048a5698da4876
SHA136ded00d136509733a1ceceacf823149fb0454b6
SHA25625ab7b7c1c615c6f305835f998698d114e5ddb783248b6af01194dae7a6b5ddf
SHA512ca3f45aaa6e1b77685cee2b4e1b82b3f3e9f8cc9d9e1cdbc2bf5267c850b82cd434574a2b05b43edadb30fa152d7a78e5aa8478657826f929145fcb9c89933d2
-
C:\Users\Admin\AppData\Local\Temp\Host Dns Alkaline.exeFilesize
227KB
MD5e8de62af8f6af96ec8048a5698da4876
SHA136ded00d136509733a1ceceacf823149fb0454b6
SHA25625ab7b7c1c615c6f305835f998698d114e5ddb783248b6af01194dae7a6b5ddf
SHA512ca3f45aaa6e1b77685cee2b4e1b82b3f3e9f8cc9d9e1cdbc2bf5267c850b82cd434574a2b05b43edadb30fa152d7a78e5aa8478657826f929145fcb9c89933d2
-
C:\Users\Admin\AppData\Roaming\Microsoft Woord\Words.exeFilesize
227KB
MD5e8de62af8f6af96ec8048a5698da4876
SHA136ded00d136509733a1ceceacf823149fb0454b6
SHA25625ab7b7c1c615c6f305835f998698d114e5ddb783248b6af01194dae7a6b5ddf
SHA512ca3f45aaa6e1b77685cee2b4e1b82b3f3e9f8cc9d9e1cdbc2bf5267c850b82cd434574a2b05b43edadb30fa152d7a78e5aa8478657826f929145fcb9c89933d2
-
C:\Users\Admin\AppData\Roaming\Microsoft Woord\Words.exeFilesize
227KB
MD5e8de62af8f6af96ec8048a5698da4876
SHA136ded00d136509733a1ceceacf823149fb0454b6
SHA25625ab7b7c1c615c6f305835f998698d114e5ddb783248b6af01194dae7a6b5ddf
SHA512ca3f45aaa6e1b77685cee2b4e1b82b3f3e9f8cc9d9e1cdbc2bf5267c850b82cd434574a2b05b43edadb30fa152d7a78e5aa8478657826f929145fcb9c89933d2
-
C:\Users\Admin\AppData\Roaming\vDTKQNauyl.jsFilesize
86KB
MD5f1ff581d7fb5fcdf9a1d53096a904083
SHA1316a63005cae181378ca97a383a868010c003f17
SHA256dbd68b74a32d859a863a71bb81b8db499879290efccfd054d91f1ef2ba6823ab
SHA512dedc3f65d18f4ed7081a957cc2c29c24027397b7b0d2b3e4562fba50289baade9b7b0e2d26e1fbac8d763eaff08854509d33435c3c7e57f33a6dfa05278e7a92
-
memory/1848-137-0x0000000000000000-mapping.dmp
-
memory/3620-140-0x0000000000000000-mapping.dmp
-
memory/4304-134-0x0000000000000000-mapping.dmp
-
memory/4512-141-0x0000000000000000-mapping.dmp
-
memory/4980-132-0x0000000000000000-mapping.dmp