Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2023, 19:19

General

  • Target

    ave6119jsjsjsjsjsjsjsjsjs.js

  • Size

    48KB

  • MD5

    55843871939bed9cad5acd5fba556736

  • SHA1

    178c0a04d0ff6c2bb2baa1e5e241f3028198b935

  • SHA256

    c4a3d1cec5bac2e0f1eb4671633ee0650b07831004130bd1d76c503655d2d26f

  • SHA512

    a172c45060209c9ee5afd1348ed346a3c1de41f4b75b7ae4f58c9f0ae0f1782dbc0d5bf4e45c977b74bdecdf11f569203861ccba4526bb2a21c18734c673a6e3

  • SSDEEP

    1536:nb1OUBLsGy18tV+FKnU7rkGsBWOnK5/YP2ay++o:nb1lwaH+FKZGsBNnK5/YPeVo

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://virvatulishop.com/labda.zip

exe.dropper

https://virvatulishop.com/files/

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ave6119jsjsjsjsjsjsjsjsjs.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle hidden -File C:\Users\Admin\AppData\Local\Temp\i5e0n45.ps1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Users\Admin\AppData\RoamingOfficeStartup\client32.exe
        "C:\Users\Admin\AppData\RoamingOfficeStartup\client32.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2560

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y1mdb2oz.yys.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\i5e0n45.ps1

    Filesize

    1KB

    MD5

    5147a0d331648239ca26cbec34e9e166

    SHA1

    cf1616c225da3983a31378a176356d434f7b89ea

    SHA256

    0de826ed5b7c41eec6d359a8b560ba8df6d957da91452f1bb9e47119f0d3de58

    SHA512

    067164752f00e9d5fdcbb6c1d7952c9fd8be0586db983c395536973507dea07e49c826683ffe97aa54c9a5b4257ab95002949a2332638cf25108e0cba2290629

  • C:\Users\Admin\AppData\RoamingOfficeStartup\HTCTL32.DLL

    Filesize

    320KB

    MD5

    c94005d2dcd2a54e40510344e0bb9435

    SHA1

    55b4a1620c5d0113811242c20bd9870a1e31d542

    SHA256

    3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

    SHA512

    2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

  • C:\Users\Admin\AppData\RoamingOfficeStartup\HTCTL32.DLL

    Filesize

    320KB

    MD5

    c94005d2dcd2a54e40510344e0bb9435

    SHA1

    55b4a1620c5d0113811242c20bd9870a1e31d542

    SHA256

    3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

    SHA512

    2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

  • C:\Users\Admin\AppData\RoamingOfficeStartup\MSVCR100.dll

    Filesize

    755KB

    MD5

    0e37fbfa79d349d672456923ec5fbbe3

    SHA1

    4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    SHA256

    8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    SHA512

    2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

  • C:\Users\Admin\AppData\RoamingOfficeStartup\NSM.LIC

    Filesize

    262B

    MD5

    b9956282a0fed076ed083892e498ac69

    SHA1

    d14a665438385203283030a189ff6c5e7c4bf518

    SHA256

    fcc6afd664a8045bd61c398be3c37a97536a199a48d277e11977f93868ae1acc

    SHA512

    7daa09113c0e8a36c91cc6d657c65851a20dff6b60ac3d2f40c5737c12c1613c553955f84d131ba2139959973fef9fc616ca5e968cb16c25acf2d4739eed87eb

  • C:\Users\Admin\AppData\RoamingOfficeStartup\PCICHEK.DLL

    Filesize

    18KB

    MD5

    104b30fef04433a2d2fd1d5f99f179fe

    SHA1

    ecb08e224a2f2772d1e53675bedc4b2c50485a41

    SHA256

    956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd

    SHA512

    5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

  • C:\Users\Admin\AppData\RoamingOfficeStartup\PCICL32.DLL

    Filesize

    3.5MB

    MD5

    9c9302e75c25c2ba996efd89a1047205

    SHA1

    9e79627ff32d5abd3382b65a509baeb31c78a7f2

    SHA256

    beb7b9a9fb02b2ad9965364fd6769ea0d8b324049da86eedd406e1c3703502c1

    SHA512

    d120b380ecd937826ab992802d8aae85f747031d50c1f6421a6c5ac32871a08f1a9c612c41946dd0aeabc01b1737cae6a1de70f9af36020af2b679e556d54fa1

  • C:\Users\Admin\AppData\RoamingOfficeStartup\PCICL32.dll

    Filesize

    3.5MB

    MD5

    9c9302e75c25c2ba996efd89a1047205

    SHA1

    9e79627ff32d5abd3382b65a509baeb31c78a7f2

    SHA256

    beb7b9a9fb02b2ad9965364fd6769ea0d8b324049da86eedd406e1c3703502c1

    SHA512

    d120b380ecd937826ab992802d8aae85f747031d50c1f6421a6c5ac32871a08f1a9c612c41946dd0aeabc01b1737cae6a1de70f9af36020af2b679e556d54fa1

  • C:\Users\Admin\AppData\RoamingOfficeStartup\client32.exe

    Filesize

    113KB

    MD5

    45fe5531717cd1b9532cbb6a5daaeb3a

    SHA1

    cb908e267a08c37d7e184f47f788e82cca38f83e

    SHA256

    ab6a4ccb752858c8c6e8223cd3510503928c3f9816cc655f0033d86c15c28ed9

    SHA512

    5ce8ea56144345802342f618c51acdbcfef3349e81e145c200ff77e217e86556f833236d85caf6ff1c8d954370bbb88e9581d9b0807b530344a8e084ede60bcb

  • C:\Users\Admin\AppData\RoamingOfficeStartup\client32.exe

    Filesize

    113KB

    MD5

    45fe5531717cd1b9532cbb6a5daaeb3a

    SHA1

    cb908e267a08c37d7e184f47f788e82cca38f83e

    SHA256

    ab6a4ccb752858c8c6e8223cd3510503928c3f9816cc655f0033d86c15c28ed9

    SHA512

    5ce8ea56144345802342f618c51acdbcfef3349e81e145c200ff77e217e86556f833236d85caf6ff1c8d954370bbb88e9581d9b0807b530344a8e084ede60bcb

  • C:\Users\Admin\AppData\RoamingOfficeStartup\client32.exe

    Filesize

    113KB

    MD5

    45fe5531717cd1b9532cbb6a5daaeb3a

    SHA1

    cb908e267a08c37d7e184f47f788e82cca38f83e

    SHA256

    ab6a4ccb752858c8c6e8223cd3510503928c3f9816cc655f0033d86c15c28ed9

    SHA512

    5ce8ea56144345802342f618c51acdbcfef3349e81e145c200ff77e217e86556f833236d85caf6ff1c8d954370bbb88e9581d9b0807b530344a8e084ede60bcb

  • C:\Users\Admin\AppData\RoamingOfficeStartup\client32.ini

    Filesize

    605B

    MD5

    a252f22f61f960c54fa32ae0de7dd17c

    SHA1

    00fe1097e70f1f6307e6bc68f40d49abb01dd2d5

    SHA256

    a5be7a73bbed8ec4e1a7819289da5412fe9ddf628941aa3b35fbe7454f148618

    SHA512

    7998e6cd43853b77e38cfedf0b6081c2965c9facb891ebd9a33db0e39b71d683f218174d87f99d5ab22983632c4c319bd63ec9dcbf1cbc81a77e3053ae3f1593

  • C:\Users\Admin\AppData\RoamingOfficeStartup\msvcr100.dll

    Filesize

    755KB

    MD5

    0e37fbfa79d349d672456923ec5fbbe3

    SHA1

    4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    SHA256

    8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    SHA512

    2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

  • C:\Users\Admin\AppData\RoamingOfficeStartup\msvcr100.dll

    Filesize

    755KB

    MD5

    0e37fbfa79d349d672456923ec5fbbe3

    SHA1

    4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    SHA256

    8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    SHA512

    2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

  • C:\Users\Admin\AppData\RoamingOfficeStartup\pcicapi.dll

    Filesize

    32KB

    MD5

    34dfb87e4200d852d1fb45dc48f93cfc

    SHA1

    35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641

    SHA256

    2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703

    SHA512

    f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

  • C:\Users\Admin\AppData\RoamingOfficeStartup\pcicapi.dll

    Filesize

    32KB

    MD5

    34dfb87e4200d852d1fb45dc48f93cfc

    SHA1

    35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641

    SHA256

    2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703

    SHA512

    f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

  • C:\Users\Admin\AppData\RoamingOfficeStartup\pcichek.dll

    Filesize

    18KB

    MD5

    104b30fef04433a2d2fd1d5f99f179fe

    SHA1

    ecb08e224a2f2772d1e53675bedc4b2c50485a41

    SHA256

    956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd

    SHA512

    5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

  • memory/2660-152-0x0000027A7EB30000-0x0000027A7EB3A000-memory.dmp

    Filesize

    40KB

  • memory/2660-151-0x0000027A7EB60000-0x0000027A7EB72000-memory.dmp

    Filesize

    72KB

  • memory/2660-142-0x0000027A64400000-0x0000027A64422000-memory.dmp

    Filesize

    136KB

  • memory/2660-150-0x0000027A7EB40000-0x0000027A7EB54000-memory.dmp

    Filesize

    80KB

  • memory/2660-188-0x0000027A63ED0000-0x0000027A63EE0000-memory.dmp

    Filesize

    64KB

  • memory/2660-148-0x0000027A63ED0000-0x0000027A63EE0000-memory.dmp

    Filesize

    64KB

  • memory/2660-149-0x0000027A63ED0000-0x0000027A63EE0000-memory.dmp

    Filesize

    64KB