Analysis
-
max time kernel
90s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2023 13:58
Static task
static1
Behavioral task
behavioral1
Sample
390Z21.ps1
Resource
win7-20230220-en
General
-
Target
390Z21.ps1
-
Size
206KB
-
MD5
7f42335561e2adb6a744f1dcb02b1505
-
SHA1
415e34780b8e144c28995e611117d7d0182f3b22
-
SHA256
c671d25e21e83929c1853e697f29b0e8ed3b69edc6add61d4d8b8bc2018afe14
-
SHA512
442c90c2f926480beb001ed1ae45bf4f9893988d135367bf51c1a8ab7f27e4a11cbec1a9fea5f6897c1dc15cbc33fa7e0f027199c281107e7c5536a63aa2058c
-
SSDEEP
3072:RO2MjmUvLcSRr0zELowmGcAK3ApfJo74Pda:RpMjbYYowmGcAK3Apxm1
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Default
185.81.157.244:6601
AsyncMutex_6S181I8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1936-188-0x0000000000400000-0x0000000000414000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exeWScript.exemshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation mshta.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1236 set thread context of 1936 1236 powershell.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exepowershell.exepowershell.exeRegSvcs.exepid process 1484 powershell.exe 1484 powershell.exe 4984 powershell.exe 4984 powershell.exe 1236 powershell.exe 1236 powershell.exe 1236 powershell.exe 1236 powershell.exe 1236 powershell.exe 1936 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1484 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeDebugPrivilege 1236 powershell.exe Token: SeDebugPrivilege 1936 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1936 RegSvcs.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
powershell.exeWScript.exepowershell.exeWScript.execmd.exemshta.exepowershell.exedescription pid process target process PID 1484 wrote to memory of 1996 1484 powershell.exe WScript.exe PID 1484 wrote to memory of 1996 1484 powershell.exe WScript.exe PID 1996 wrote to memory of 4984 1996 WScript.exe powershell.exe PID 1996 wrote to memory of 4984 1996 WScript.exe powershell.exe PID 4984 wrote to memory of 2400 4984 powershell.exe WScript.exe PID 4984 wrote to memory of 2400 4984 powershell.exe WScript.exe PID 2400 wrote to memory of 3572 2400 WScript.exe cmd.exe PID 2400 wrote to memory of 3572 2400 WScript.exe cmd.exe PID 3572 wrote to memory of 2164 3572 cmd.exe mshta.exe PID 3572 wrote to memory of 2164 3572 cmd.exe mshta.exe PID 2164 wrote to memory of 1236 2164 mshta.exe powershell.exe PID 2164 wrote to memory of 1236 2164 mshta.exe powershell.exe PID 1236 wrote to memory of 1684 1236 powershell.exe RegSvcs.exe PID 1236 wrote to memory of 1684 1236 powershell.exe RegSvcs.exe PID 1236 wrote to memory of 1684 1236 powershell.exe RegSvcs.exe PID 1236 wrote to memory of 1936 1236 powershell.exe RegSvcs.exe PID 1236 wrote to memory of 1936 1236 powershell.exe RegSvcs.exe PID 1236 wrote to memory of 1936 1236 powershell.exe RegSvcs.exe PID 1236 wrote to memory of 1936 1236 powershell.exe RegSvcs.exe PID 1236 wrote to memory of 1936 1236 powershell.exe RegSvcs.exe PID 1236 wrote to memory of 1936 1236 powershell.exe RegSvcs.exe PID 1236 wrote to memory of 1936 1236 powershell.exe RegSvcs.exe PID 1236 wrote to memory of 1936 1236 powershell.exe RegSvcs.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\390Z21.ps11⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\Document\BT.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy RemoteSigned -Command &{$BLNLS='ReadAllText';$T='C:\ProgramData\Document\BT.ps1';IEx([<#1#>IO.File<#1#>]::$BLNLS($T))}3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\schtasks\Document.vbs"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\Document\Loader.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powe"+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+""+"rshell -Execu"+"tionP"+"olicy"+" Bypass & 'C:\ProgramData\Document\Document.ps1'"", 0:close")6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & 'C:\ProgramData\Document\Document.ps1'7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Document\BT.ps1Filesize
822B
MD5a185048be8e4dcc4af37a21033364350
SHA16203dd67cf4e9958d52fe7fb8dd34e2364416046
SHA2563311eb6e7226e8e21c3ae7b3f29c9859d0be7b10736cb3883d5c453f59a41583
SHA51275b51d7cadfcd656d92431848809f62e3c902f20ddd36665eec41d92d622b62f4830b04094052df9c7fb8b827b0dad8d4589dbacb1e5c4bee65bbbc794c7d32c
-
C:\ProgramData\Document\BT.vbsFilesize
482B
MD5d81d9785f8a33a52adbf7761bb81483c
SHA1c7f97c27e4ad633369c9eca1be36335356486727
SHA256cd30619863fb29e056c285521902eda2d820052f5cbc7a5d92ad331eab6460c4
SHA5120c08b68c6b64a57ba4494e20b5c840f3f013aa2873d03aa1d2a017c707614479afe024cfd1cdde17851d0f36cfc34a895eea1e41d4a4118067ec366c19bf41cf
-
C:\ProgramData\Document\Document.ps1Filesize
202KB
MD56e7968ef23d12120b090badbb5ab6c68
SHA1a15cf14da3192a7e64fbd0e9ea90ad2c2ab03f18
SHA25605593d5c9e42cc15217ca2db5c27a955aa2cedae87c9471b2181aad36ca8edaa
SHA5128d120fd8859ff68103a35fb342c799045cda3f92a039b844cfab18fd75f7a831afca2b95e68aadf864207b46eb40d8b96d5ba7fb44c2a1cf7d2c947fdcad929c
-
C:\ProgramData\Document\Loader.batFilesize
276B
MD5aaff07ba1501352dabd41d75b0e8bb4f
SHA1d55ed9a18b657313801b7da2e2e5d79b1c0ae033
SHA256b74497ce30b1a5e218bdad0bec6bd9ab24f38ab6881fa52c9f651f418bf6dc7a
SHA5125afe35b094429427fd0c8e7194baa497d43c64a4d4a195e5789a145ab0ddc608a29e941f66d9dee2ded3e0253d501676c4632076bf6e5897383fc240a4d0f333
-
C:\ProgramData\schtasks\Document.vbsFilesize
652B
MD53fdf59c6cc932ccfb273ee77a5338509
SHA1dc0bfd3323aff0fdabd00f98496f30cb1a2aee5f
SHA256d8ded725a6dec74218c880a7c80c20755efecb0a8e3d82d5fae5963652c215e4
SHA512e049dc02cc84139cd775fc1bfb901574b8fb2aff393a8da696f2602c8adda17bb0dfb62c19a31d8b15ade2179b5e54c41deacb3b01d785d1cb621dc0a0a0aa80
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5223bd4ae02766ddc32e6145fd1a29301
SHA1900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA2561022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
SHA512648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD527fdb1beb89b56345e585d480be3026b
SHA12626e41ca27668518d01c04e1579f77027ff31a1
SHA256ef8cd66cc241c6d899919ae6f8369334b20202bd4ad49acfa546d29300c533d2
SHA512bd8208c8763ad8a6c25b6363b8e0e2a3c694e4e0cabfe4ce5d40945bd1f4274b7da976997f825e95c4455bf6b2e20b5bd960609b172f7c70d3521cb2ab24d49a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD570595b5937369a2592a524db67e208d3
SHA1d989b934d9388104189f365694e794835aa6f52f
SHA256be09b93a020e2e86a0b3c7c3f3d3e2c45f888944b1036df738385ede16f595c8
SHA512edb412886187a2740eb7e284b16838bdd9f011aba1f4581f1fed25a86cdfe9b2ab4df863edeb3db6b072805439d57b10f3e0a1f2daabe1ee56db275ad2ad61e5
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_olm0lpyo.syo.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1236-186-0x000001C046290000-0x000001C0462A0000-memory.dmpFilesize
64KB
-
memory/1236-187-0x000001C046290000-0x000001C0462A0000-memory.dmpFilesize
64KB
-
memory/1484-138-0x000001B9A2040000-0x000001B9A2062000-memory.dmpFilesize
136KB
-
memory/1484-145-0x000001B985920000-0x000001B985930000-memory.dmpFilesize
64KB
-
memory/1484-144-0x000001B985920000-0x000001B985930000-memory.dmpFilesize
64KB
-
memory/1484-143-0x000001B985920000-0x000001B985930000-memory.dmpFilesize
64KB
-
memory/1936-192-0x0000000005CB0000-0x0000000005D42000-memory.dmpFilesize
584KB
-
memory/1936-188-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1936-190-0x00000000056E0000-0x00000000056F0000-memory.dmpFilesize
64KB
-
memory/1936-191-0x0000000006070000-0x0000000006614000-memory.dmpFilesize
5.6MB
-
memory/1936-193-0x0000000005CA0000-0x0000000005CAA000-memory.dmpFilesize
40KB
-
memory/1936-196-0x0000000006D40000-0x0000000006DDC000-memory.dmpFilesize
624KB
-
memory/1936-197-0x0000000006DE0000-0x0000000006E46000-memory.dmpFilesize
408KB
-
memory/1936-198-0x00000000056E0000-0x00000000056F0000-memory.dmpFilesize
64KB
-
memory/4984-170-0x000001CE04C20000-0x000001CE04C30000-memory.dmpFilesize
64KB
-
memory/4984-162-0x000001CE04C20000-0x000001CE04C30000-memory.dmpFilesize
64KB
-
memory/4984-156-0x000001CE04C20000-0x000001CE04C30000-memory.dmpFilesize
64KB