Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 10:01
Static task
static1
Behavioral task
behavioral1
Sample
Attachment.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Attachment.js
Resource
win10v2004-20220812-en
General
-
Target
Attachment.js
-
Size
9KB
-
MD5
0d7aac781fcb032d7e6261638b17318a
-
SHA1
cec8bda522ab70b14410759ffa12e69e00a892c3
-
SHA256
0250ebf092c4efff85ec3996a9011d37d091de867cce42d174c5c2a6c61a4d12
-
SHA512
a3813a1a337c4f8390c0b3cdb9134830ce444975322099115e8cfe4e7c6b567488d39e31922ffe02417c0263fd51c38953c84fa5be4f5a83da833bb060b5fbcf
-
SSDEEP
192:JDohqMizzyhd9jRpUT7BUPsqzr/8qzrYihEvWXJtjB034BeRISx5RxV1ctOsqBt+:Jsliyhr1/aeX/jB034BeR7cIsWtY0lRI
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
wscript.exeflow pid process 8 3316 wscript.exe 10 3316 wscript.exe 12 3316 wscript.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
HHG.exepid process 3752 HHG.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation wscript.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
HHG.exeCaspol.exesvchost.exedescription pid process target process PID 3752 set thread context of 4892 3752 HHG.exe Caspol.exe PID 4892 set thread context of 2804 4892 Caspol.exe Explorer.EXE PID 4836 set thread context of 2804 4836 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1392 1676 WerFault.exe Firefox.exe -
Processes:
svchost.exedescription ioc process Key created \Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Caspol.exesvchost.exepid process 4892 Caspol.exe 4892 Caspol.exe 4892 Caspol.exe 4892 Caspol.exe 4892 Caspol.exe 4892 Caspol.exe 4892 Caspol.exe 4892 Caspol.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2804 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Caspol.exesvchost.exepid process 4892 Caspol.exe 4892 Caspol.exe 4892 Caspol.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe 4836 svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Caspol.exesvchost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4892 Caspol.exe Token: SeDebugPrivilege 4836 svchost.exe Token: SeShutdownPrivilege 2804 Explorer.EXE Token: SeCreatePagefilePrivilege 2804 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
wscript.exeHHG.exeExplorer.EXEsvchost.exedescription pid process target process PID 3316 wrote to memory of 3752 3316 wscript.exe HHG.exe PID 3316 wrote to memory of 3752 3316 wscript.exe HHG.exe PID 3316 wrote to memory of 3752 3316 wscript.exe HHG.exe PID 3752 wrote to memory of 4892 3752 HHG.exe Caspol.exe PID 3752 wrote to memory of 4892 3752 HHG.exe Caspol.exe PID 3752 wrote to memory of 4892 3752 HHG.exe Caspol.exe PID 3752 wrote to memory of 4892 3752 HHG.exe Caspol.exe PID 3752 wrote to memory of 4892 3752 HHG.exe Caspol.exe PID 3752 wrote to memory of 4892 3752 HHG.exe Caspol.exe PID 2804 wrote to memory of 4836 2804 Explorer.EXE svchost.exe PID 2804 wrote to memory of 4836 2804 Explorer.EXE svchost.exe PID 2804 wrote to memory of 4836 2804 Explorer.EXE svchost.exe PID 4836 wrote to memory of 1676 4836 svchost.exe Firefox.exe PID 4836 wrote to memory of 1676 4836 svchost.exe Firefox.exe PID 4836 wrote to memory of 1676 4836 svchost.exe Firefox.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Attachment.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HHG.exe"C:\Users\Admin\AppData\Local\Temp\HHG.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1676 -s 1844⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 456 -p 1676 -ip 16761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HHG.exeFilesize
282KB
MD558b8732ed17532b518bd90b68b934b23
SHA1dbb672289a9ebde17cb77424615a1c186995d1f3
SHA256f6eb53bca5075725d889aa5de1f4541cd764bed2bd46aeefcfa4a1b018b6a4fb
SHA512824e7e7cdccb4d60f72ad70fd73ea8184b1ed7b1d7b2e9a9426ec58380f3f4f769bee8b55d5d8c2450a6bfe37a2f737cc6a88c77e6bf1dde1984edc8c4e3b75c
-
C:\Users\Admin\AppData\Local\Temp\HHG.exeFilesize
282KB
MD558b8732ed17532b518bd90b68b934b23
SHA1dbb672289a9ebde17cb77424615a1c186995d1f3
SHA256f6eb53bca5075725d889aa5de1f4541cd764bed2bd46aeefcfa4a1b018b6a4fb
SHA512824e7e7cdccb4d60f72ad70fd73ea8184b1ed7b1d7b2e9a9426ec58380f3f4f769bee8b55d5d8c2450a6bfe37a2f737cc6a88c77e6bf1dde1984edc8c4e3b75c
-
memory/2804-150-0x0000000002BD0000-0x0000000002C78000-memory.dmpFilesize
672KB
-
memory/2804-149-0x0000000002BD0000-0x0000000002C78000-memory.dmpFilesize
672KB
-
memory/2804-142-0x00000000028D0000-0x00000000029A7000-memory.dmpFilesize
860KB
-
memory/3752-135-0x0000000000750000-0x000000000079C000-memory.dmpFilesize
304KB
-
memory/3752-132-0x0000000000000000-mapping.dmp
-
memory/4836-145-0x0000000000BE0000-0x0000000000BEE000-memory.dmpFilesize
56KB
-
memory/4836-148-0x0000000001000000-0x000000000108F000-memory.dmpFilesize
572KB
-
memory/4836-147-0x00000000006A0000-0x00000000006CD000-memory.dmpFilesize
180KB
-
memory/4836-146-0x0000000001200000-0x000000000154A000-memory.dmpFilesize
3.3MB
-
memory/4836-143-0x0000000000000000-mapping.dmp
-
memory/4892-140-0x0000000000F10000-0x000000000125A000-memory.dmpFilesize
3.3MB
-
memory/4892-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4892-141-0x0000000000EC0000-0x0000000000ED0000-memory.dmpFilesize
64KB
-
memory/4892-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4892-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4892-137-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4892-136-0x0000000000000000-mapping.dmp