e55f78dc679c0246702846641703c48e76f292f5d8fb18696b52008ac753420c

Analysis

max time kernel
150s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fix/terrines.js
Size

132B
MD5

28048969a3d56e40a9d773ba8248044b
SHA1

1dc77ffe2f01911f72b4bb53ed1ba2718fa1a460
SHA256

8e6917eda43d25d78bb4f140a689572e02152b7e0b8be6ca509fb51fed4cb9fb
SHA512

20b5979c8294431bfc7b4b5c94ac5d7a1ba33f996c808fce06a967085e625963665d83cd80c3861370be919229c47146ef85eaebe6901f1b0846295b30c194ef

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4736 powershell.exe
4736 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4736 powershell.exe

pid	process
4736	powershell.exe
4736	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4736	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 912 wrote to memory of 4736	912	wscript.exe	powershell.exe
PID 912 wrote to memory of 4736	912	wscript.exe	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\fix\terrines.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass fix\slammed.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4736-132-0x0000000000000000-mapping.dmp

Download
memory/4736-133-0x0000019FF7840000-0x0000019FF7862000-memory.dmp

Filesize
136KB

Download
memory/4736-134-0x00007FFD83700000-0x00007FFD841C1000-memory.dmp

Filesize
10.8MB

Download
memory/4736-135-0x00007FFD83700000-0x00007FFD841C1000-memory.dmp

Filesize
10.8MB

Download