Overview

overview

6

Static

static

1

sample.js

windows10-2004-x64

sample.js

macos-10.15-amd64

Resubmissions

02-04-2023 13:04

230402-qa9m5shg2x 1

02-04-2023 12:57

230402-p7e95ahf9x 6

02-04-2023 12:51

230402-p3p9jagd39 1

Analysis

  • max time kernel
    339s
  • max time network
    343s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2023 12:57

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    sample.js

  • Size

    13KB

  • MD5

    1212b023dbaa2d445977844278307e8b

  • SHA1

    e5a7f1bd2fd3f4d53c333443a2dba7ebfc9b5a2e

  • SHA256

    bbafe8444c662de8c9100fe202daddab5452cb8306ebb9571f2fed3018111025

  • SHA512

    aa545486fb752954b1751d0f30256b33d613a3c683b49a6262360969d14517446b1c1600f957f5ddeff505b09a0e0da8ebb04fa6d5444c2b4e19a13e0625ab3a

  • SSDEEP

    384:rDoVGuzeVoOsKWElKeGMhUhHhhbkHs28rtGi:reGuCVoOsKZI1MCBhbGirR

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 13 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\sample.js
    1⤵
      PID:1568
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe"
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3280
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
      1⤵
        PID:544
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4912
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
        1⤵
          PID:3004
        • C:\Windows\system32\dism.exe
          "C:\Windows\system32\dism.exe"
          1⤵
          • Drops file in Windows directory
          PID:4880
        • C:\Windows\system32\mmc.exe
          "C:\Windows\system32\mmc.exe" C:\Windows\system32\diskmgmt.msc
          1⤵
          • Enumerates connected drives
          • Drops file in System32 directory
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2764
        • C:\Windows\System32\vdsldr.exe
          C:\Windows\System32\vdsldr.exe -Embedding
          1⤵
            PID:5020
          • C:\Windows\System32\vds.exe
            C:\Windows\System32\vds.exe
            1⤵
            • Enumerates connected drives
            • Writes to the Master Boot Record (MBR)
            • Checks SCSI registry key(s)
            PID:444
          • C:\Windows\system32\LogonUI.exe
            "LogonUI.exe" /flags:0x0 /state0:0xa396d855 /state1:0x41c64e6d
            1⤵
            • Drops desktop.ini file(s)
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2556

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Bootkit

          1
          T1067

          Privilege Escalation

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Query Registry

          2
          T1012

          Peripheral Device Discovery

          2
          T1120

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-1675742406-747946869-1029867430-1000\ReadOnly\LockScreen_O\LockScreen___1280_0720_notdimmed.jpg
            Filesize

            455KB

            MD5

            b9dfe74c194e4dfce3ffe0a983935b60

            SHA1

            8133a2461e147657c5890d8df07e2e91407358b0

            SHA256

            3a2378b0a72b11b3c8106006f126d4ed97533372452746399855ec58d89e1851

            SHA512

            b0e7802c2862ab791c5289b06e1751ed2232e6ee84cb5c3a2519e5e5c739012eaf3227cbe97996a45b19746ddf1ee435b07c64ec11e7abbc80fe49db75e85101

            Download Submit
          • C:\Windows\Logs\DISM\dism.log
            Filesize

            196KB

            MD5

            f5fa2de2128a478ff612b3d7511af888

            SHA1

            71f3beaf7ca1be29fa7afbe1a557b9114b13cda8

            SHA256

            c5f5fcac40e10b093cc772b1d22f2ac3a2d619cc04f561e74d6729ff7e39e255

            SHA512

            6872bb521a328caabad4cbb76a8ff09dc11d95da0417b4e1a24543f418325186e3775795ce11a9b4a7b1eff3cf599d08a66e43b59e9faf7f6a595ecf917a00b6

            Download Submit
          • memory/3280-142-0x00007FF8A8E50000-0x00007FF8A8E6D000-memory.dmp
            Filesize

            116KB

            Download
          • memory/3280-138-0x00007FF8AA3B0000-0x00007FF8AA3C8000-memory.dmp
            Filesize

            96KB

            Download
          • memory/3280-139-0x00007FF8A9360000-0x00007FF8A9377000-memory.dmp
            Filesize

            92KB

            Download
          • memory/3280-140-0x00007FF8A8E90000-0x00007FF8A8EA1000-memory.dmp
            Filesize

            68KB

            Download
          • memory/3280-135-0x00007FF62D340000-0x00007FF62D438000-memory.dmp
            Filesize

            992KB

            Download
          • memory/3280-141-0x00007FF8A8E70000-0x00007FF8A8E87000-memory.dmp
            Filesize

            92KB

            Download
          • memory/3280-143-0x00007FF8A8E30000-0x00007FF8A8E41000-memory.dmp
            Filesize

            68KB

            Download
          • memory/3280-144-0x00000229C5F50000-0x00000229C6FFB000-memory.dmp
            Filesize

            16.7MB

            Download
          • memory/3280-145-0x00007FF8A7D10000-0x00007FF8A7D77000-memory.dmp
            Filesize

            412KB

            Download
          • memory/3280-177-0x00000229C5F50000-0x00000229C6FFB000-memory.dmp
            Filesize

            16.7MB

            Download
          • memory/3280-137-0x00007FF8A93B0000-0x00007FF8A9664000-memory.dmp
            Filesize

            2.7MB

            Download
          • memory/3280-136-0x00007FF8AC0F0000-0x00007FF8AC124000-memory.dmp
            Filesize

            208KB

            Download