59eae7e55775a390cd710598128c8eca3e83809ed561b433e5471961d0ec999f

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2023, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Document#002184.js
Size 767KB
Sample230706-j4earsba3w
SHA256 59eae7e55775a390cd710598128c8eca3e83809ed561b433e5471961d0ec999f
MD5 9e360d1872f3cc9fe40b0ab7467dd9e8
SHA1 afb2f675020d1de318cd89dff49d19b7dd1a6499
SHA512 c6bb42f24e3015ed7a73ac34a0772be04ec87e80fa324230333801dc935b6898018c2c60f0d90cbe489908fe38ac7d475bb94f6d5c85a937446215c10c41a468
SSDEEP 12288:gdfaPoG0EfEbaHkcC6eB18YMfeu7N2TcxWiAQBBwuuALemLoXtfXfNC2oRrQ9Vuk:gdYoG0Ef8aJveB18YMWwN2TUWiAQBBdm
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
21	1152	wscript.exe
27	1152	wscript.exe
35	1152	wscript.exe
37	1152	wscript.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 2 IoCs

pid	Process
2684	rundll32.exe
4536	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3088	powershell.exe
3088	powershell.exe
2684	rundll32.exe
2684	rundll32.exe
4848	powershell.exe
4848	powershell.exe
4536	rundll32.exe
4536	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3088	1152	wscript.exe	89
PID 1152 wrote to memory of 3088	1152	wscript.exe	89
PID 3088 wrote to memory of 2684	3088	powershell.exe	91
PID 3088 wrote to memory of 2684	3088	powershell.exe	91
PID 1152 wrote to memory of 4848	1152	wscript.exe	92
PID 1152 wrote to memory of 4848	1152	wscript.exe	92
PID 4848 wrote to memory of 4536	4848	powershell.exe	94
PID 4848 wrote to memory of 4536	4848	powershell.exe	94

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Document#002184.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" rundll32 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\221300.dat,vcab /k fistashka838
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\221300.dat,vcab /k fistashka838
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" rundll32 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\576025.dat,vcab /k fistashka838
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\576025.dat,vcab /k fistashka838
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
MD5 440cb38dbee06645cc8b74d51f6e5f71
SHA1 d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA512 3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 5d2fcee8c6d15b34beb556f98700e4e8f207a06ba3e28efe7bc1f34784280623
MD5 e924b42def82a0dc711ba227d46b2328
SHA1 9b4f97aa90f59f3647b3f4e419f6195ff0ed34fd
SHA512 f8c58207a8b8d9cfa8b190156aa24ee0ac908a2bc4a2d8f742b14a00f05bae88ac2b5fc5b5d20924e8f6ed98e277f16f93982c266926d670511fa4171426cbdc
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_dqdhrkwi.tc3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dqdhrkwi.tc3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

221300.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\221300.dat
Size 825KB
SHA256 725925f7b4d80264dc5a4d148d413a13af8b61ff738f14d37174da43d12801bd
MD5 aaf3387c21987923430bca5226590848
SHA1 48f4934d18af2288c34bed4c46d6516244b37a04
SHA512 84efb6bfa8d7b0ed205e7a9f2f057c3e4a7f9d0947973c44504414a6567ba84f9737a4f401384474db21d5d96e93a615f4b04404f104d99b505b50534fe11705
SSDEEP 24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9XF3NQ:WF+uTsAx0tlpidvdktF3NQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

221300.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\221300.dat
Size 825KB
SHA256 725925f7b4d80264dc5a4d148d413a13af8b61ff738f14d37174da43d12801bd
MD5 aaf3387c21987923430bca5226590848
SHA1 48f4934d18af2288c34bed4c46d6516244b37a04
SHA512 84efb6bfa8d7b0ed205e7a9f2f057c3e4a7f9d0947973c44504414a6567ba84f9737a4f401384474db21d5d96e93a615f4b04404f104d99b505b50534fe11705
SSDEEP 24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9XF3NQ:WF+uTsAx0tlpidvdktF3NQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

576025.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\576025.dat
Size 825KB
SHA256 da23db098e7ec12890fcd03ac5ab59b7ada2ee5f6b61a9831d65b0c97d1e3c5f
MD5 8be7b3769ae755566bee2308a923807d
SHA1 d9b890390cd4a872d8d625edce29d293936ef6e8
SHA512 0b465b9b0ec978ff921b3a0c91fb10f1314e920c6f9b13373b4ae609a72116eb85cf0723702e93fb9d286a9beed204015e1d7ccbd673c09dec6c76707986109d
SSDEEP 24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9ZF3Nm:WF+uTsAx0tlpidvdkbF3Nm
MD5 SHA1 SHA512 SSDEEP

Submit Download

576025.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\576025.dat
Size 825KB
SHA256 da23db098e7ec12890fcd03ac5ab59b7ada2ee5f6b61a9831d65b0c97d1e3c5f
MD5 8be7b3769ae755566bee2308a923807d
SHA1 d9b890390cd4a872d8d625edce29d293936ef6e8
SHA512 0b465b9b0ec978ff921b3a0c91fb10f1314e920c6f9b13373b4ae609a72116eb85cf0723702e93fb9d286a9beed204015e1d7ccbd673c09dec6c76707986109d
SSDEEP 24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9ZF3Nm:WF+uTsAx0tlpidvdkbF3Nm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2684-157-0x00000215A5F40000-0x00000215A5F44000-memory.dmp

Download

memory/3088-148-0x000001FAF28A0000-0x000001FAF28C2000-memory.dmp

Download

memory/3088-155-0x000001FAF0670000-0x000001FAF0680000-memory.dmp

Download

memory/3088-175-0x000001FAF0670000-0x000001FAF0680000-memory.dmp

Download