c2a6ef0312aeb7a379f899eb834ac8d799b162c916dcdea4d2a923eeb57c237f

Analysis

max time kernel
39s
max time network
105s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Document#002173.js
Size 784KB
Sample230706-lq3gjsbc2t
SHA256 c2a6ef0312aeb7a379f899eb834ac8d799b162c916dcdea4d2a923eeb57c237f
MD5 876be153a230c332bb0e8dedc094a340
SHA1 ec1bd16be3372a801c755882cb8d46b8b553eb39
SHA512 e1f65d106b56dd1cf1a2ed8f09aa5c92991c22a01d86cba0ebb40dec773ea663dc05948eb3cde9e9418525a1e5b7559ce83b7d1d1046c9173b087d3df1f0c946
SSDEEP 24576:qgQURQzFYsc0CpgVUxIhrI/PUhtzMvrDGiaexbqlVsm3hPK7JRrFNeQ1btKd/n7e:XRQzFYsc0WgVUxIhrI/PUhtzMvrDGiaq
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
4	2352	wscript.exe
6	2352	wscript.exe
8	2352	wscript.exe
10	2352	wscript.exe

Downloads MZ/PE file

Loads dropped DLL 1 IoCs

pid	Process
2600	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	wscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	wscript.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1464	powershell.exe
2600	rundll32.exe
2600	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1464	2352	wscript.exe	29
PID 2352 wrote to memory of 1464	2352	wscript.exe	29
PID 2352 wrote to memory of 1464	2352	wscript.exe	29
PID 1464 wrote to memory of 2600	1464	powershell.exe	31
PID 1464 wrote to memory of 2600	1464	powershell.exe	31
PID 1464 wrote to memory of 2600	1464	powershell.exe	31

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Document#002173.js
1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" rundll32 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\507346.dat,vcab /k fistashka838
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\507346.dat vcab /k fistashka838
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cab737E.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab737E.tmp
Size 62KB
SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
MD5 3ac860860707baaf32469fa7cc7c0192
SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
SSDEEP 1536:MRxM2u+06GOIVUvVmMKAfUfsrPa1jfCu18ZNMe3v:KMH+F3IacMZ2CPACu1GN7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar7584.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar7584.tmp
Size 164KB
SHA256 c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
MD5 4ff65ad929cd9a367680e0e5b1c08166
SHA1 c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA512 f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
SSDEEP 1536:FUdJXlCUs0Rv0/29TFrJW5ibN/5YJkKCdru2hRIwjYvjCQ9vbmt6t0:FIJXq0Rn5JaJkHru2h2jCEvt2
MD5 SHA1 SHA512 SSDEEP

Submit Download

507346.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\507346.dat
Size 825KB
SHA256 d2ec3c0c88dfa1c27bd8225522f99ec50bcbbe15677b3cf34a2b0ba5a415e973
MD5 ed60961dc668399d829b01608d0032c5
SHA1 15ebac7bca2ee4a0aa2a24c0db934073bddd55ed
SHA512 a7d1d73db143ebc0000ef854e8f6658850aabe0f9575bcce0ce9500df3086821a234c5dfa563c76591d015b19e03e2e90e5d2fb15944e12dc3a42a63bff81d62
SSDEEP 24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9KF3Nn:WF+uTsAx0tlpidvdk8F3Nn
MD5 SHA1 SHA512 SSDEEP

Submit Download

507346.dat

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\507346.dat
Size 825KB
SHA256 d2ec3c0c88dfa1c27bd8225522f99ec50bcbbe15677b3cf34a2b0ba5a415e973
MD5 ed60961dc668399d829b01608d0032c5
SHA1 15ebac7bca2ee4a0aa2a24c0db934073bddd55ed
SHA512 a7d1d73db143ebc0000ef854e8f6658850aabe0f9575bcce0ce9500df3086821a234c5dfa563c76591d015b19e03e2e90e5d2fb15944e12dc3a42a63bff81d62
SSDEEP 24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9KF3Nn:WF+uTsAx0tlpidvdk8F3Nn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1464-78-0x000000001B1C0000-0x000000001B4A2000-memory.dmp

Download

memory/1464-88-0x0000000002410000-0x0000000002418000-memory.dmp

Download

memory/1464-98-0x00000000026F0000-0x0000000002770000-memory.dmp

Download

memory/1464-99-0x00000000026F0000-0x0000000002770000-memory.dmp

Download

memory/1464-109-0x00000000026F0000-0x0000000002770000-memory.dmp

Download

memory/1464-130-0x00000000026FB000-0x0000000002732000-memory.dmp

Download

memory/2600-139-0x0000000000110000-0x0000000000114000-memory.dmp

Download