Analysis
-
max time kernel
202s -
max time network
207s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
17-01-2023 19:11
Static task
static1
Behavioral task
behavioral1
Sample
98e3648add4ab0724ebeb54eb720e8ad97ad52b0.js
Resource
win7-20221111-en
General
-
Target
98e3648add4ab0724ebeb54eb720e8ad97ad52b0.js
-
Size
378KB
-
MD5
484e1f6925d5957e9d486e420dc010b7
-
SHA1
98e3648add4ab0724ebeb54eb720e8ad97ad52b0
-
SHA256
9005a39c203e068daa077fe244e2608d36852dbef6f6ce8b28cc5cc015b89b1b
-
SHA512
5b32912e30b446357ce6fe626b8136ae3262cdf4c60b7bc56b16171156a8979001a1a52168c0fe34b2b7526379b4519b7b04c86e17e18f40a62b7361acb0617c
-
SSDEEP
6144:6V0EJTElOz43XdvK4tHOh6WfkHi4FjqWkQ2M4MMPpsiscuzAOgied24iD+:cJMW43NsZghqekPpNqAOgBd7iD+
Malware Config
Signatures
-
Blocklisted process makes network request 14 IoCs
Processes:
wscript.exewscript.exeflow pid Process 5 1152 wscript.exe 6 1152 wscript.exe 11 1832 wscript.exe 12 1832 wscript.exe 13 1152 wscript.exe 15 1152 wscript.exe 16 1152 wscript.exe 18 1152 wscript.exe 20 1152 wscript.exe 24 1152 wscript.exe 25 1152 wscript.exe 30 1152 wscript.exe 33 1152 wscript.exe 37 1152 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
bin.exepid Process 1788 bin.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bin.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation bin.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TzTlSUHDie.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TzTlSUHDie.js wscript.exe -
Loads dropped DLL 1 IoCs
Processes:
wscript.exepid Process 1832 wscript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
bin.exewscript.exedescription pid Process procid_target PID 1788 set thread context of 1264 1788 bin.exe 12 PID 1788 set thread context of 1264 1788 bin.exe 12 PID 1832 set thread context of 1264 1832 wscript.exe 12 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
wscript.exedescription ioc Process Key created \Registry\User\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
bin.exewscript.exepid Process 1788 bin.exe 1788 bin.exe 1788 bin.exe 1788 bin.exe 1788 bin.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid Process 1264 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
bin.exewscript.exepid Process 1788 bin.exe 1788 bin.exe 1788 bin.exe 1788 bin.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe 1832 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
bin.exewscript.exeExplorer.EXEdescription pid Process Token: SeDebugPrivilege 1788 bin.exe Token: SeDebugPrivilege 1832 wscript.exe Token: SeShutdownPrivilege 1264 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid Process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid Process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
wscript.exeExplorer.EXEbin.exewscript.exedescription pid Process procid_target PID 856 wrote to memory of 1152 856 wscript.exe 27 PID 856 wrote to memory of 1152 856 wscript.exe 27 PID 856 wrote to memory of 1152 856 wscript.exe 27 PID 856 wrote to memory of 1788 856 wscript.exe 28 PID 856 wrote to memory of 1788 856 wscript.exe 28 PID 856 wrote to memory of 1788 856 wscript.exe 28 PID 856 wrote to memory of 1788 856 wscript.exe 28 PID 1264 wrote to memory of 308 1264 Explorer.EXE 33 PID 1264 wrote to memory of 308 1264 Explorer.EXE 33 PID 1264 wrote to memory of 308 1264 Explorer.EXE 33 PID 1264 wrote to memory of 308 1264 Explorer.EXE 33 PID 1264 wrote to memory of 1628 1264 Explorer.EXE 32 PID 1264 wrote to memory of 1628 1264 Explorer.EXE 32 PID 1264 wrote to memory of 1628 1264 Explorer.EXE 32 PID 1264 wrote to memory of 1628 1264 Explorer.EXE 32 PID 1788 wrote to memory of 1832 1788 bin.exe 34 PID 1788 wrote to memory of 1832 1788 bin.exe 34 PID 1788 wrote to memory of 1832 1788 bin.exe 34 PID 1788 wrote to memory of 1832 1788 bin.exe 34 PID 1832 wrote to memory of 1608 1832 wscript.exe 36 PID 1832 wrote to memory of 1608 1832 wscript.exe 36 PID 1832 wrote to memory of 1608 1832 wscript.exe 36 PID 1832 wrote to memory of 1608 1832 wscript.exe 36 PID 1832 wrote to memory of 1608 1832 wscript.exe 36
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\98e3648add4ab0724ebeb54eb720e8ad97ad52b0.js2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\TzTlSUHDie.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:1152
-
-
C:\Users\Admin\AppData\Local\Temp\bin.exe"C:\Users\Admin\AppData\Local\Temp\bin.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵PID:1608
-
-
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵PID:1628
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵PID:308
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185KB
MD5f9fdfca55156f35ea48a17947d091f4d
SHA115f10040cf10535deed5ca028150ed847a585d01
SHA2567258963be005d6914901a62c591c56427553f62537f86d70965af16dae57c0d0
SHA51253caa12467706839406c40e8e8a925a67f8c51ddc6abb0bf7db8ca61e03af09714cc954e959c89dae91fb45c07fc113a076e0ab34806933ca7deed520113c302
-
Filesize
185KB
MD5f9fdfca55156f35ea48a17947d091f4d
SHA115f10040cf10535deed5ca028150ed847a585d01
SHA2567258963be005d6914901a62c591c56427553f62537f86d70965af16dae57c0d0
SHA51253caa12467706839406c40e8e8a925a67f8c51ddc6abb0bf7db8ca61e03af09714cc954e959c89dae91fb45c07fc113a076e0ab34806933ca7deed520113c302
-
Filesize
18KB
MD590c052e2282de1c12470fc54d62681d9
SHA1ea069b254dde1f6cad46afedf55c69d4516a0d7a
SHA256be62476863ca538e76f33e4758a5a5af8609d681026c4e325d8d667470aa9097
SHA51273661062644236fcd76f689a8271f5f2c875468fbfdd4a4431a2b419c8bc093129345ee9b83d4f87eaa389a1ff12e776ba5d0d5845899931e1b72c32d4cb5ea7
-
Filesize
895KB
MD51eb6acf76a15b74b38333af47dc1218d
SHA1a3fbc817f59b6a8899dc338cc15a75cdd17dfff1
SHA256a5ef3a78eb333b0e6dca194ea711dcbb036119a788ecfe125f05176fb0fb70a3
SHA512717931aa928de150abbb70d523c7dbd472bfa6c511ab55e0b50df8d9661d33635156ed7b750285fa383cdd4064f225ea022f0bead3e066ee2beba84ef5731c15