Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-01-2023 00:47
Static task
static1
Behavioral task
behavioral1
Sample
98e3648add4ab0724ebeb54eb720e8ad97ad52b0.js
Resource
win7-20220812-en
General
-
Target
98e3648add4ab0724ebeb54eb720e8ad97ad52b0.js
-
Size
378KB
-
MD5
484e1f6925d5957e9d486e420dc010b7
-
SHA1
98e3648add4ab0724ebeb54eb720e8ad97ad52b0
-
SHA256
9005a39c203e068daa077fe244e2608d36852dbef6f6ce8b28cc5cc015b89b1b
-
SHA512
5b32912e30b446357ce6fe626b8136ae3262cdf4c60b7bc56b16171156a8979001a1a52168c0fe34b2b7526379b4519b7b04c86e17e18f40a62b7361acb0617c
-
SSDEEP
6144:6V0EJTElOz43XdvK4tHOh6WfkHi4FjqWkQ2M4MMPpsiscuzAOgied24iD+:cJMW43NsZghqekPpNqAOgBd7iD+
Malware Config
Signatures
-
Blocklisted process makes network request 14 IoCs
Processes:
wscript.exeflow pid process 4 1184 wscript.exe 5 1184 wscript.exe 6 1184 wscript.exe 14 1184 wscript.exe 18 1184 wscript.exe 20 1184 wscript.exe 25 1184 wscript.exe 28 1184 wscript.exe 30 1184 wscript.exe 37 1184 wscript.exe 42 1184 wscript.exe 46 1184 wscript.exe 52 1184 wscript.exe 56 1184 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
bin.exepid process 2016 bin.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bin.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation bin.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TzTlSUHDie.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TzTlSUHDie.js wscript.exe -
Loads dropped DLL 1 IoCs
Processes:
systray.exepid process 1580 systray.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
bin.exesystray.exedescription pid process target process PID 2016 set thread context of 1244 2016 bin.exe Explorer.EXE PID 1580 set thread context of 1244 1580 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
bin.exesystray.exepid process 2016 bin.exe 2016 bin.exe 2016 bin.exe 2016 bin.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
bin.exesystray.exepid process 2016 bin.exe 2016 bin.exe 2016 bin.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe 1580 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bin.exesystray.exedescription pid process Token: SeDebugPrivilege 2016 bin.exe Token: SeDebugPrivilege 1580 systray.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
wscript.exeExplorer.EXEsystray.exedescription pid process target process PID 904 wrote to memory of 1184 904 wscript.exe wscript.exe PID 904 wrote to memory of 1184 904 wscript.exe wscript.exe PID 904 wrote to memory of 1184 904 wscript.exe wscript.exe PID 904 wrote to memory of 2016 904 wscript.exe bin.exe PID 904 wrote to memory of 2016 904 wscript.exe bin.exe PID 904 wrote to memory of 2016 904 wscript.exe bin.exe PID 904 wrote to memory of 2016 904 wscript.exe bin.exe PID 1244 wrote to memory of 1580 1244 Explorer.EXE systray.exe PID 1244 wrote to memory of 1580 1244 Explorer.EXE systray.exe PID 1244 wrote to memory of 1580 1244 Explorer.EXE systray.exe PID 1244 wrote to memory of 1580 1244 Explorer.EXE systray.exe PID 1580 wrote to memory of 2004 1580 systray.exe Firefox.exe PID 1580 wrote to memory of 2004 1580 systray.exe Firefox.exe PID 1580 wrote to memory of 2004 1580 systray.exe Firefox.exe PID 1580 wrote to memory of 2004 1580 systray.exe Firefox.exe PID 1580 wrote to memory of 2004 1580 systray.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\98e3648add4ab0724ebeb54eb720e8ad97ad52b0.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\TzTlSUHDie.js"3⤵
- Blocklisted process makes network request
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\bin.exe"C:\Users\Admin\AppData\Local\Temp\bin.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bin.exeFilesize
185KB
MD5f9fdfca55156f35ea48a17947d091f4d
SHA115f10040cf10535deed5ca028150ed847a585d01
SHA2567258963be005d6914901a62c591c56427553f62537f86d70965af16dae57c0d0
SHA51253caa12467706839406c40e8e8a925a67f8c51ddc6abb0bf7db8ca61e03af09714cc954e959c89dae91fb45c07fc113a076e0ab34806933ca7deed520113c302
-
C:\Users\Admin\AppData\Local\Temp\bin.exeFilesize
185KB
MD5f9fdfca55156f35ea48a17947d091f4d
SHA115f10040cf10535deed5ca028150ed847a585d01
SHA2567258963be005d6914901a62c591c56427553f62537f86d70965af16dae57c0d0
SHA51253caa12467706839406c40e8e8a925a67f8c51ddc6abb0bf7db8ca61e03af09714cc954e959c89dae91fb45c07fc113a076e0ab34806933ca7deed520113c302
-
C:\Users\Admin\AppData\Roaming\TzTlSUHDie.jsFilesize
18KB
MD590c052e2282de1c12470fc54d62681d9
SHA1ea069b254dde1f6cad46afedf55c69d4516a0d7a
SHA256be62476863ca538e76f33e4758a5a5af8609d681026c4e325d8d667470aa9097
SHA51273661062644236fcd76f689a8271f5f2c875468fbfdd4a4431a2b419c8bc093129345ee9b83d4f87eaa389a1ff12e776ba5d0d5845899931e1b72c32d4cb5ea7
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
810KB
MD5c6ec991471d42128268ea10236d9cdb8
SHA1d569350d02db6a118136220da8de40a9973084f1
SHA2561b755cc3093dd45a0df857854aedfeb3c8f3622cff5bc491f2d492ebfa3ef8e0
SHA512a67ed46547b9270c8a5a7a947b375cb6baf3211072f90170aae2bb6ce9c4fe9d7be3e9d782420dcfdbc19a1f232b3be561ca503b80e8dc3e036a62c54cad5b57
-
memory/1184-58-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmpFilesize
8KB
-
memory/1184-54-0x0000000000000000-mapping.dmp
-
memory/1244-73-0x00000000066F0000-0x00000000067DC000-memory.dmpFilesize
944KB
-
memory/1244-70-0x00000000066F0000-0x00000000067DC000-memory.dmpFilesize
944KB
-
memory/1244-62-0x0000000006610000-0x00000000066E7000-memory.dmpFilesize
860KB
-
memory/1580-69-0x0000000001CD0000-0x0000000001D5F000-memory.dmpFilesize
572KB
-
memory/1580-65-0x0000000000080000-0x0000000000085000-memory.dmpFilesize
20KB
-
memory/1580-66-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1580-63-0x0000000000000000-mapping.dmp
-
memory/1580-68-0x0000000001FA0000-0x00000000022A3000-memory.dmpFilesize
3.0MB
-
memory/1580-71-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1580-72-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB
-
memory/2016-64-0x0000000001200000-0x000000000122F000-memory.dmpFilesize
188KB
-
memory/2016-61-0x0000000000220000-0x0000000000230000-memory.dmpFilesize
64KB
-
memory/2016-60-0x0000000000740000-0x0000000000A43000-memory.dmpFilesize
3.0MB
-
memory/2016-59-0x0000000001200000-0x000000000122F000-memory.dmpFilesize
188KB
-
memory/2016-56-0x0000000000000000-mapping.dmp