Overview

overview

8

Static

static

1

Scan_06_23...23).js

windows7-x64

8

Scan_06_23...23).js

windows10-2004-x64

8

Analysis

  • max time kernel
    97s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2023, 11:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Scan_06_23_Payment(123).js
  • Size 752KB
  • Sample230627-n323naeh21
  • SHA256 d4a69a6a68e105c1757fc667b0a67fa46628dec97f29af4649a958feb1f37b23
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Scan_06_23_Payment(123).js
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\532249.dat,vcab /k zefirka748
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" rundll32 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\24010.dat,vcab /k zefirka748
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1348
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\24010.dat,vcab /k zefirka748
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:260

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_c2n2cbj3.zvq.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c2n2cbj3.zvq.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512
        Submit Download

        24010.dat
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\24010.dat
        • Size 591KB
        • SHA256 e07a15b7bf50840c2472d7bff82d9f1e8026430d36f19ea255fd6df2a90d365d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        24010.dat
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\24010.dat
        • Size 591KB
        • SHA256 e07a15b7bf50840c2472d7bff82d9f1e8026430d36f19ea255fd6df2a90d365d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        532249.dat
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\532249.dat
        • Size 591KB
        • SHA256 e07a15b7bf50840c2472d7bff82d9f1e8026430d36f19ea255fd6df2a90d365d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        532249.dat
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\532249.dat
        • Size 591KB
        • SHA256 e07a15b7bf50840c2472d7bff82d9f1e8026430d36f19ea255fd6df2a90d365d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1348-151-0x0000028FFFC60000-0x0000028FFFC82000-memory.dmp
        Download

        memory/2000-144-0x00000286B4270000-0x00000286B4274000-memory.dmp
        Download