Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17/01/2023, 19:31
Static task
static1
Behavioral task
behavioral1
Sample
98e3648add4ab0724ebeb54eb720e8ad97ad52b0.js
Resource
win7-20220812-en
General
-
Target
98e3648add4ab0724ebeb54eb720e8ad97ad52b0.js
-
Size
378KB
-
MD5
484e1f6925d5957e9d486e420dc010b7
-
SHA1
98e3648add4ab0724ebeb54eb720e8ad97ad52b0
-
SHA256
9005a39c203e068daa077fe244e2608d36852dbef6f6ce8b28cc5cc015b89b1b
-
SHA512
5b32912e30b446357ce6fe626b8136ae3262cdf4c60b7bc56b16171156a8979001a1a52168c0fe34b2b7526379b4519b7b04c86e17e18f40a62b7361acb0617c
-
SSDEEP
6144:6V0EJTElOz43XdvK4tHOh6WfkHi4FjqWkQ2M4MMPpsiscuzAOgied24iD+:cJMW43NsZghqekPpNqAOgBd7iD+
Malware Config
Signatures
-
Blocklisted process makes network request 5 IoCs
flow pid Process 8 380 wscript.exe 27 380 wscript.exe 41 380 wscript.exe 50 380 wscript.exe 77 380 wscript.exe -
Executes dropped EXE 1 IoCs
pid Process 4188 bin.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation bin.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TzTlSUHDie.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TzTlSUHDie.js wscript.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4188 set thread context of 2648 4188 bin.exe 62 PID 4728 set thread context of 2648 4728 ipconfig.exe 62 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1916 4424 WerFault.exe 88 -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4728 ipconfig.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 4188 bin.exe 4188 bin.exe 4188 bin.exe 4188 bin.exe 4188 bin.exe 4188 bin.exe 4188 bin.exe 4188 bin.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4188 bin.exe 4188 bin.exe 4188 bin.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe 4728 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4188 bin.exe Token: SeDebugPrivilege 4728 ipconfig.exe Token: SeShutdownPrivilege 2648 Explorer.EXE Token: SeCreatePagefilePrivilege 2648 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2244 wrote to memory of 380 2244 wscript.exe 80 PID 2244 wrote to memory of 380 2244 wscript.exe 80 PID 2244 wrote to memory of 4188 2244 wscript.exe 81 PID 2244 wrote to memory of 4188 2244 wscript.exe 81 PID 2244 wrote to memory of 4188 2244 wscript.exe 81 PID 2648 wrote to memory of 4728 2648 Explorer.EXE 83 PID 2648 wrote to memory of 4728 2648 Explorer.EXE 83 PID 2648 wrote to memory of 4728 2648 Explorer.EXE 83 PID 4728 wrote to memory of 4424 4728 ipconfig.exe 88 PID 4728 wrote to memory of 4424 4728 ipconfig.exe 88 PID 4728 wrote to memory of 4424 4728 ipconfig.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\98e3648add4ab0724ebeb54eb720e8ad97ad52b0.js2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\TzTlSUHDie.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:380
-
-
C:\Users\Admin\AppData\Local\Temp\bin.exe"C:\Users\Admin\AppData\Local\Temp\bin.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4188
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4424
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4424 -s 1924⤵
- Program crash
PID:1916
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 464 -p 4424 -ip 44241⤵PID:2220
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185KB
MD5f9fdfca55156f35ea48a17947d091f4d
SHA115f10040cf10535deed5ca028150ed847a585d01
SHA2567258963be005d6914901a62c591c56427553f62537f86d70965af16dae57c0d0
SHA51253caa12467706839406c40e8e8a925a67f8c51ddc6abb0bf7db8ca61e03af09714cc954e959c89dae91fb45c07fc113a076e0ab34806933ca7deed520113c302
-
Filesize
185KB
MD5f9fdfca55156f35ea48a17947d091f4d
SHA115f10040cf10535deed5ca028150ed847a585d01
SHA2567258963be005d6914901a62c591c56427553f62537f86d70965af16dae57c0d0
SHA51253caa12467706839406c40e8e8a925a67f8c51ddc6abb0bf7db8ca61e03af09714cc954e959c89dae91fb45c07fc113a076e0ab34806933ca7deed520113c302
-
Filesize
18KB
MD590c052e2282de1c12470fc54d62681d9
SHA1ea069b254dde1f6cad46afedf55c69d4516a0d7a
SHA256be62476863ca538e76f33e4758a5a5af8609d681026c4e325d8d667470aa9097
SHA51273661062644236fcd76f689a8271f5f2c875468fbfdd4a4431a2b419c8bc093129345ee9b83d4f87eaa389a1ff12e776ba5d0d5845899931e1b72c32d4cb5ea7