Malware Analysis Report

2024-11-15 09:14

Sample ID 230602-nd22csbe3w
Target ProjectFunding_547624_Jun01.js
SHA256 3290ebf23a0f763607fa8c7a64b84da516d015adf663380dea9bf5ac19929543
Tags
qakbot obama266 1685611378 banker stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3290ebf23a0f763607fa8c7a64b84da516d015adf663380dea9bf5ac19929543

Threat Level: Known bad

The file ProjectFunding_547624_Jun01.js was found to be: Known bad.

Malicious Activity Summary

qakbot obama266 1685611378 banker stealer trojan

Qakbot/Qbot

Blocklisted process makes network request

Loads dropped DLL

Enumerates connected drives

Drops file in Windows directory

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-06-02 11:17

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-06-02 11:17

Reported

2023-06-02 11:20

Platform

win7-20230220-en

Max time kernel

150s

Max time network

128s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\ProjectFunding_547624_Jun01.js

Signatures

Qakbot/Qbot

trojan banker stealer qakbot

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI4D93.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\6ddce9.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\Installer\6ddce9.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIDE3F.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\6ddceb.msi C:\Windows\system32\msiexec.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\wscript.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1604 wrote to memory of 1384 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\wscript.exe
PID 1604 wrote to memory of 1384 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\wscript.exe
PID 1604 wrote to memory of 1384 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\wscript.exe
PID 1604 wrote to memory of 1536 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\rundll32.exe
PID 1604 wrote to memory of 1536 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\rundll32.exe
PID 1604 wrote to memory of 1536 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\rundll32.exe
PID 1536 wrote to memory of 1168 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1536 wrote to memory of 1168 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1536 wrote to memory of 1168 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1536 wrote to memory of 1168 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1536 wrote to memory of 1168 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1536 wrote to memory of 1168 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1536 wrote to memory of 1168 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1168 wrote to memory of 1588 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\wermgr.exe
PID 1168 wrote to memory of 1588 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\wermgr.exe
PID 1168 wrote to memory of 1588 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\wermgr.exe
PID 1168 wrote to memory of 1588 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\wermgr.exe
PID 1168 wrote to memory of 1588 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\wermgr.exe
PID 1168 wrote to memory of 1588 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\wermgr.exe
PID 1168 wrote to memory of 1588 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\wermgr.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\ProjectFunding_547624_Jun01.js

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\DrvInst.exe

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A0" "00000000000003B4"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next

C:\Windows\SysWOW64\wermgr.exe

C:\Windows\SysWOW64\wermgr.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 garokelka.com udp
NL 217.195.153.225:443 garokelka.com tcp
US 8.8.8.8:53 lakirasa.com udp
BR 216.238.111.194:443 lakirasa.com tcp
US 8.8.8.8:53 tofinka.com udp
IR 185.235.138.66:443 tofinka.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 88.221.25.169:80 apps.identrust.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab4B46.tmp

MD5 fc4666cbca561e864e7fdf883a9e6661
SHA1 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA256 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512 c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 3ac860860707baaf32469fa7cc7c0192
SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

C:\Users\Admin\AppData\Local\Temp\Tar4C18.tmp

MD5 4ff65ad929cd9a367680e0e5b1c08166
SHA1 c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256 c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512 f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fafbe2d4130db4af966c1ce595fdb65b
SHA1 732c1dd5497730879981c162e9ffa30d4d4f2903
SHA256 d57c625464f818e5c6e632189c6781cb9849653488baf69d007689379c630cfc
SHA512 5d92007ffcb7494e1456f859a3da4c141f2b5d6b0e5c66b820873341e220d39c12f3ab2774d5a540ba13289b7dabfd4ceab6a15e4d403d92d41e0d1bccbe7e39

C:\Windows\Installer\MSI4D93.tmp

MD5 a3c065e111432e342e8754c3e9da6562
SHA1 fa58f4cadeb9fced0c5c1fb6f2b127d63c5380ed
SHA256 85c68da65685531de1dd54b79e5bdc9317a55ecaa9d368512c0833cef524fdbc
SHA512 b02ccd5cc9c7c055d84bdb866f01b94726915bdeda1ce485fa87c10a90e5813fbd888d48efeeff11827123fd6c06d471434ba2710fc450825d9e424da504407f

C:\Config.Msi\6ddcea.rbs

MD5 f942661916dc60438a7a90a9a1cb24db
SHA1 11aa422dafc3cd834e7b6ded55c8e04078487d9c
SHA256 56a7c58e485c41d5ec371022241e01fc7e1bdef091cde92a6ce797fc9e0164ae
SHA512 927394161669e2bd52883833e7b97ce310817ebd9acc52167ce1aef2cfec35172639745619591919b7afd3d7939f6e054d05d769406ac29f506e580df661383a

C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

MD5 5b3a664d2ccccf6faf97f3b20fcbc394
SHA1 2a91983f5b7cb06fefc9c817e62ebcb27dc49cc9
SHA256 a57358d032bfc007c174a5f9e8fb4c39ea8531d7fd77e1952db7c7de078e9907
SHA512 c3c08f9f6274b18b629c91ed5ec0af6292de636f20630bea512e97f9866fc5d0296313d4f7d8d815cdff7a73c106e343fdf56cf9b017f3e48ea81bdfe10db4ae

C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

MD5 0d4c9f15ce74465c59ae36a27f98c817
SHA1 9cce8eefa4d3d9c5e161c5dbb860cfe1489c6b1a
SHA256 d24e3399060b51f3a1c9d41a67de2601888a35c99da8db70070d757bb3f1913a
SHA512 9bed0eafc2cf2a2360850ca1070ffb04ac14f04c78379485998a93f45012b5c11cc7f6f68129f65b8b5f90437cb965908c6a1bb9d83a56b068d6bde1d5fdad1f

\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

MD5 5b3a664d2ccccf6faf97f3b20fcbc394
SHA1 2a91983f5b7cb06fefc9c817e62ebcb27dc49cc9
SHA256 a57358d032bfc007c174a5f9e8fb4c39ea8531d7fd77e1952db7c7de078e9907
SHA512 c3c08f9f6274b18b629c91ed5ec0af6292de636f20630bea512e97f9866fc5d0296313d4f7d8d815cdff7a73c106e343fdf56cf9b017f3e48ea81bdfe10db4ae

\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

MD5 5b3a664d2ccccf6faf97f3b20fcbc394
SHA1 2a91983f5b7cb06fefc9c817e62ebcb27dc49cc9
SHA256 a57358d032bfc007c174a5f9e8fb4c39ea8531d7fd77e1952db7c7de078e9907
SHA512 c3c08f9f6274b18b629c91ed5ec0af6292de636f20630bea512e97f9866fc5d0296313d4f7d8d815cdff7a73c106e343fdf56cf9b017f3e48ea81bdfe10db4ae

\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

MD5 5b3a664d2ccccf6faf97f3b20fcbc394
SHA1 2a91983f5b7cb06fefc9c817e62ebcb27dc49cc9
SHA256 a57358d032bfc007c174a5f9e8fb4c39ea8531d7fd77e1952db7c7de078e9907
SHA512 c3c08f9f6274b18b629c91ed5ec0af6292de636f20630bea512e97f9866fc5d0296313d4f7d8d815cdff7a73c106e343fdf56cf9b017f3e48ea81bdfe10db4ae

\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

MD5 5b3a664d2ccccf6faf97f3b20fcbc394
SHA1 2a91983f5b7cb06fefc9c817e62ebcb27dc49cc9
SHA256 a57358d032bfc007c174a5f9e8fb4c39ea8531d7fd77e1952db7c7de078e9907
SHA512 c3c08f9f6274b18b629c91ed5ec0af6292de636f20630bea512e97f9866fc5d0296313d4f7d8d815cdff7a73c106e343fdf56cf9b017f3e48ea81bdfe10db4ae

memory/1168-157-0x0000000000130000-0x0000000000133000-memory.dmp

memory/1168-158-0x0000000000140000-0x0000000000164000-memory.dmp

\??\PIPE\wkssvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1588-164-0x0000000000130000-0x0000000000132000-memory.dmp

memory/1588-165-0x00000000000C0000-0x00000000000E4000-memory.dmp

memory/1588-171-0x00000000000C0000-0x00000000000E4000-memory.dmp

memory/1588-172-0x00000000000C0000-0x00000000000E4000-memory.dmp

memory/1588-173-0x00000000000C0000-0x00000000000E4000-memory.dmp

memory/1588-174-0x00000000000C0000-0x00000000000E4000-memory.dmp

memory/1588-175-0x00000000000C0000-0x00000000000E4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-06-02 11:17

Reported

2023-06-02 11:20

Platform

win10v2004-20230220-en

Max time kernel

128s

Max time network

130s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\ProjectFunding_547624_Jun01.js

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\wscript.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wscript.exe N/A

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\ProjectFunding_547624_Jun01.js

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

Network

Country Destination Domain Proto
US 8.8.8.8:53 garokelka.com udp
NL 217.195.153.225:443 garokelka.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 254.27.24.67.in-addr.arpa udp
US 8.8.8.8:53 140.145.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 lakirasa.com udp
BR 216.238.111.194:443 lakirasa.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 254.133.241.8.in-addr.arpa udp
US 8.8.8.8:53 38.148.119.40.in-addr.arpa udp
US 20.189.173.11:443 tcp
US 8.8.8.8:53 tofinka.com udp
IR 185.235.138.66:443 tofinka.com tcp
US 8.8.8.8:53 koriska.com udp
US 149.102.225.64:443 koriska.com tcp
US 8.8.8.8:53 66.138.235.185.in-addr.arpa udp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 retrenia.com udp
FR 176.31.25.218:443 retrenia.com tcp
US 8.8.8.8:53 gurakis.com udp
SE 94.131.98.140:443 gurakis.com tcp

Files

N/A