59eae7e55775a390cd710598128c8eca3e83809ed561b433e5471961d0ec999f

Analysis

max time kernel
39s
max time network
104s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Document#002184.js
Size 767KB
Sample230706-j4earsba3w
SHA256 59eae7e55775a390cd710598128c8eca3e83809ed561b433e5471961d0ec999f
MD5 9e360d1872f3cc9fe40b0ab7467dd9e8
SHA1 afb2f675020d1de318cd89dff49d19b7dd1a6499
SHA512 c6bb42f24e3015ed7a73ac34a0772be04ec87e80fa324230333801dc935b6898018c2c60f0d90cbe489908fe38ac7d475bb94f6d5c85a937446215c10c41a468
SSDEEP 12288:gdfaPoG0EfEbaHkcC6eB18YMfeu7N2TcxWiAQBBwuuALemLoXtfXfNC2oRrQ9Vuk:gdYoG0Ef8aJveB18YMWwN2TUWiAQBBdm
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
4	3048	wscript.exe
6	3048	wscript.exe
8	3048	wscript.exe
10	3048	wscript.exe

Downloads MZ/PE file

Loads dropped DLL 1 IoCs

pid	Process
2864	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	wscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	wscript.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2424	powershell.exe
2864	rundll32.exe
2864	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2424	3048	wscript.exe	29
PID 3048 wrote to memory of 2424	3048	wscript.exe	29
PID 3048 wrote to memory of 2424	3048	wscript.exe	29
PID 2424 wrote to memory of 2864	2424	powershell.exe	31
PID 2424 wrote to memory of 2864	2424	powershell.exe	31
PID 2424 wrote to memory of 2864	2424	powershell.exe	31

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Document#002184.js
1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" rundll32 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\755600.dat,vcab /k fistashka838
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\755600.dat vcab /k fistashka838
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cab50D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab50D1.tmp
Size 62KB
SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
MD5 3ac860860707baaf32469fa7cc7c0192
SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
SSDEEP 1536:MRxM2u+06GOIVUvVmMKAfUfsrPa1jfCu18ZNMe3v:KMH+F3IacMZ2CPACu1GN7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar522C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar522C.tmp
Size 164KB
SHA256 c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
MD5 4ff65ad929cd9a367680e0e5b1c08166
SHA1 c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA512 f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
SSDEEP 1536:FUdJXlCUs0Rv0/29TFrJW5ibN/5YJkKCdru2hRIwjYvjCQ9vbmt6t0:FIJXq0Rn5JaJkHru2h2jCEvt2
MD5 SHA1 SHA512 SSDEEP

Submit Download

755600.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\755600.dat
Size 825KB
SHA256 725925f7b4d80264dc5a4d148d413a13af8b61ff738f14d37174da43d12801bd
MD5 aaf3387c21987923430bca5226590848
SHA1 48f4934d18af2288c34bed4c46d6516244b37a04
SHA512 84efb6bfa8d7b0ed205e7a9f2f057c3e4a7f9d0947973c44504414a6567ba84f9737a4f401384474db21d5d96e93a615f4b04404f104d99b505b50534fe11705
SSDEEP 24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9XF3NQ:WF+uTsAx0tlpidvdktF3NQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

755600.dat

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\755600.dat
Size 825KB
SHA256 725925f7b4d80264dc5a4d148d413a13af8b61ff738f14d37174da43d12801bd
MD5 aaf3387c21987923430bca5226590848
SHA1 48f4934d18af2288c34bed4c46d6516244b37a04
SHA512 84efb6bfa8d7b0ed205e7a9f2f057c3e4a7f9d0947973c44504414a6567ba84f9737a4f401384474db21d5d96e93a615f4b04404f104d99b505b50534fe11705
SSDEEP 24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9XF3NQ:WF+uTsAx0tlpidvdktF3NQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2424-71-0x00000000026B0000-0x0000000002730000-memory.dmp

Download

memory/2424-79-0x000000001B110000-0x000000001B3F2000-memory.dmp

Download

memory/2424-89-0x0000000001F50000-0x0000000001F58000-memory.dmp

Download

memory/2424-135-0x00000000026B4000-0x00000000026B7000-memory.dmp

Download

memory/2424-136-0x00000000026BB000-0x00000000026F2000-memory.dmp

Download

memory/2864-160-0x00000000000A0000-0x00000000000A4000-memory.dmp

Download