Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2023 13:31
Static task
static1
Behavioral task
behavioral1
Sample
05734699.js
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
05734699.js
Resource
win10v2004-20230621-en
General
-
Target
05734699.js
-
Size
352KB
-
MD5
b662081c24306347fe96b0461cac1c76
-
SHA1
cf8a471dba51c21fd65cd5a0794654952a7559d1
-
SHA256
989ce4d82fd24dbd20f261ec89891f90756b404e98364108517d897113dfd302
-
SHA512
8c2bac8ef44d597e611018da40f8417d4114d0001061a278844177048356794f1a8a9e1cf8720aefca00e4f4d792f6357baa54d3c7e6b519e3570c31e04cf8d2
-
SSDEEP
6144:NJrV1fMvYNeDXN+2nQZw8eCBKBSB6G9tJsD5rPTb4hYWKv16SK4jfQ7577:NJx1fMvHuZHeCogYD5OYWEwX
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 1 IoCs
Processes:
java.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qcrzxzs.txt java.exe -
Loads dropped DLL 1 IoCs
Processes:
java.exepid Process 4196 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qcrzxzs = "\"C:\\Users\\Admin\\AppData\\Roaming\\qcrzxzs.txt\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qcrzxzs = "\"C:\\Users\\Admin\\AppData\\Roaming\\qcrzxzs.txt\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 26 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid Process Token: SeIncreaseQuotaPrivilege 548 WMIC.exe Token: SeSecurityPrivilege 548 WMIC.exe Token: SeTakeOwnershipPrivilege 548 WMIC.exe Token: SeLoadDriverPrivilege 548 WMIC.exe Token: SeSystemProfilePrivilege 548 WMIC.exe Token: SeSystemtimePrivilege 548 WMIC.exe Token: SeProfSingleProcessPrivilege 548 WMIC.exe Token: SeIncBasePriorityPrivilege 548 WMIC.exe Token: SeCreatePagefilePrivilege 548 WMIC.exe Token: SeBackupPrivilege 548 WMIC.exe Token: SeRestorePrivilege 548 WMIC.exe Token: SeShutdownPrivilege 548 WMIC.exe Token: SeDebugPrivilege 548 WMIC.exe Token: SeSystemEnvironmentPrivilege 548 WMIC.exe Token: SeRemoteShutdownPrivilege 548 WMIC.exe Token: SeUndockPrivilege 548 WMIC.exe Token: SeManageVolumePrivilege 548 WMIC.exe Token: 33 548 WMIC.exe Token: 34 548 WMIC.exe Token: 35 548 WMIC.exe Token: 36 548 WMIC.exe Token: SeIncreaseQuotaPrivilege 548 WMIC.exe Token: SeSecurityPrivilege 548 WMIC.exe Token: SeTakeOwnershipPrivilege 548 WMIC.exe Token: SeLoadDriverPrivilege 548 WMIC.exe Token: SeSystemProfilePrivilege 548 WMIC.exe Token: SeSystemtimePrivilege 548 WMIC.exe Token: SeProfSingleProcessPrivilege 548 WMIC.exe Token: SeIncBasePriorityPrivilege 548 WMIC.exe Token: SeCreatePagefilePrivilege 548 WMIC.exe Token: SeBackupPrivilege 548 WMIC.exe Token: SeRestorePrivilege 548 WMIC.exe Token: SeShutdownPrivilege 548 WMIC.exe Token: SeDebugPrivilege 548 WMIC.exe Token: SeSystemEnvironmentPrivilege 548 WMIC.exe Token: SeRemoteShutdownPrivilege 548 WMIC.exe Token: SeUndockPrivilege 548 WMIC.exe Token: SeManageVolumePrivilege 548 WMIC.exe Token: 33 548 WMIC.exe Token: 34 548 WMIC.exe Token: 35 548 WMIC.exe Token: 36 548 WMIC.exe Token: SeIncreaseQuotaPrivilege 3780 WMIC.exe Token: SeSecurityPrivilege 3780 WMIC.exe Token: SeTakeOwnershipPrivilege 3780 WMIC.exe Token: SeLoadDriverPrivilege 3780 WMIC.exe Token: SeSystemProfilePrivilege 3780 WMIC.exe Token: SeSystemtimePrivilege 3780 WMIC.exe Token: SeProfSingleProcessPrivilege 3780 WMIC.exe Token: SeIncBasePriorityPrivilege 3780 WMIC.exe Token: SeCreatePagefilePrivilege 3780 WMIC.exe Token: SeBackupPrivilege 3780 WMIC.exe Token: SeRestorePrivilege 3780 WMIC.exe Token: SeShutdownPrivilege 3780 WMIC.exe Token: SeDebugPrivilege 3780 WMIC.exe Token: SeSystemEnvironmentPrivilege 3780 WMIC.exe Token: SeRemoteShutdownPrivilege 3780 WMIC.exe Token: SeUndockPrivilege 3780 WMIC.exe Token: SeManageVolumePrivilege 3780 WMIC.exe Token: 33 3780 WMIC.exe Token: 34 3780 WMIC.exe Token: 35 3780 WMIC.exe Token: 36 3780 WMIC.exe Token: SeIncreaseQuotaPrivilege 3780 WMIC.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
wscript.exejavaw.exejava.execmd.exejava.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 5092 wrote to memory of 1100 5092 wscript.exe 81 PID 5092 wrote to memory of 1100 5092 wscript.exe 81 PID 1100 wrote to memory of 4124 1100 javaw.exe 82 PID 1100 wrote to memory of 4124 1100 javaw.exe 82 PID 4124 wrote to memory of 4556 4124 java.exe 84 PID 4124 wrote to memory of 4556 4124 java.exe 84 PID 4124 wrote to memory of 4196 4124 java.exe 85 PID 4124 wrote to memory of 4196 4124 java.exe 85 PID 4556 wrote to memory of 1968 4556 cmd.exe 88 PID 4556 wrote to memory of 1968 4556 cmd.exe 88 PID 4196 wrote to memory of 3460 4196 java.exe 89 PID 4196 wrote to memory of 3460 4196 java.exe 89 PID 3460 wrote to memory of 548 3460 cmd.exe 91 PID 3460 wrote to memory of 548 3460 cmd.exe 91 PID 4196 wrote to memory of 944 4196 java.exe 93 PID 4196 wrote to memory of 944 4196 java.exe 93 PID 944 wrote to memory of 3780 944 cmd.exe 95 PID 944 wrote to memory of 3780 944 cmd.exe 95 PID 4196 wrote to memory of 5104 4196 java.exe 96 PID 4196 wrote to memory of 5104 4196 java.exe 96 PID 5104 wrote to memory of 4156 5104 cmd.exe 98 PID 5104 wrote to memory of 4156 5104 cmd.exe 98 PID 4196 wrote to memory of 4576 4196 java.exe 99 PID 4196 wrote to memory of 4576 4196 java.exe 99 PID 4576 wrote to memory of 4496 4576 cmd.exe 101 PID 4576 wrote to memory of 4496 4576 cmd.exe 101 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\05734699.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\qcrzxzs.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\qcrzxzs.txt"3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\qcrzxzs.txt"4⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\qcrzxzs.txt"5⤵
- Creates scheduled task(s)
PID:1968
-
-
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\qcrzxzs.txt"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"5⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list6⤵
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"5⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"5⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list6⤵PID:4156
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"5⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list6⤵PID:4496
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD553fb578617fc1cdf6d480d925f56fda8
SHA1582dd9a58436dedb8e267d68b019a60c347369c9
SHA2560651267267096365fa60bf27769ad2fc3942ea61dc700d2acea32a38cd058889
SHA5124fc5ef81e6327b3fdb4f114110b0c81b0f1142112f80ee7b25175786032a1c06d07d9ddf71506f3021507c1aa14df46b3944842de968a53c7c75fbd59bdd3e48
-
Filesize
50B
MD545a91e605ecbf7ceef3b0f2a0d777ef2
SHA17c996e558ec7fdbc9384bf577a1f6d68a9d0eda4
SHA256447d2f6da6457328f4ec8ba812cafdf17a742085c11c4afb2ace2875d1e7bfa5
SHA51265ac556c636577992eb404ddd94e15a0ca0708c568c850e19e4bafe159a9baf62c880cac60dbd2516e26468936ff0da4792bc250f8b69bb9f8e55846303da26d
-
Filesize
241KB
MD5e02979ecd43bcc9061eb2b494ab5af50
SHA13122ac0e751660f646c73b10c4f79685aa65c545
SHA256a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a
SHA5121e6f7dcb6a557c9b896412a48dd017c16f7a52fa2b9ab513593c9ecd118e86083979821ca7a3e2f098ee349200c823c759cec6599740dd391cb5f354dc29b372
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-508929744-1894537824-211734425-1000\83aa4cc77f591dfc2374580bbd95f6ba_3db77c8d-8b44-4cdd-80bd-b67b97edf7a0
Filesize45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
Filesize
164KB
MD5e42e41dca87067441bf95942122244ef
SHA1b322424df5aec8e114bf9fcf179884db9722eeda
SHA2563aaca9e3fafd07c13175168d00a2d3fc4c7837990da32d5d80eb14303d53b132
SHA5122f40e875a916b56b6acd099192824fd52d3cb4b2aac785d7c6e80c45b98971e7fed7790f4ada946b0520180d2dd0819867ab326324bae50c04ba514c8d9aca5e
-
Filesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
Filesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
Filesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
Filesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
Filesize
164KB
MD5e42e41dca87067441bf95942122244ef
SHA1b322424df5aec8e114bf9fcf179884db9722eeda
SHA2563aaca9e3fafd07c13175168d00a2d3fc4c7837990da32d5d80eb14303d53b132
SHA5122f40e875a916b56b6acd099192824fd52d3cb4b2aac785d7c6e80c45b98971e7fed7790f4ada946b0520180d2dd0819867ab326324bae50c04ba514c8d9aca5e
-
Filesize
164KB
MD5e42e41dca87067441bf95942122244ef
SHA1b322424df5aec8e114bf9fcf179884db9722eeda
SHA2563aaca9e3fafd07c13175168d00a2d3fc4c7837990da32d5d80eb14303d53b132
SHA5122f40e875a916b56b6acd099192824fd52d3cb4b2aac785d7c6e80c45b98971e7fed7790f4ada946b0520180d2dd0819867ab326324bae50c04ba514c8d9aca5e
-
Filesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
Filesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
Filesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
Filesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
Filesize
164KB
MD5e42e41dca87067441bf95942122244ef
SHA1b322424df5aec8e114bf9fcf179884db9722eeda
SHA2563aaca9e3fafd07c13175168d00a2d3fc4c7837990da32d5d80eb14303d53b132
SHA5122f40e875a916b56b6acd099192824fd52d3cb4b2aac785d7c6e80c45b98971e7fed7790f4ada946b0520180d2dd0819867ab326324bae50c04ba514c8d9aca5e