Analysis
-
max time kernel
28s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25/08/2023, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
Income tax return for Dircon Construction LLC.wsf
Resource
win7-20230712-en
General
-
Target
Income tax return for Dircon Construction LLC.wsf
-
Size
137KB
-
MD5
1d733488ff0c33ff91b29d6ba0218ab5
-
SHA1
588633522abe168911aa9f0566ebd4c8f7db869e
-
SHA256
0bafff7ce08cfb66ce61ad3cb87d0373c54d8460606813b365121799d2da377a
-
SHA512
4529e92369efa0d76af65d8a19b06a730f7022d16be56c1b9e2a566eff94aada06094aee0ca13d75584b4dd941b914fcc540c7d4f7811a25104e02208ac23f29
-
SSDEEP
768:sXh/6FXh/6qXh/6FXh/6XXh/6AXh/6/Xh/6nXh/6TXh/6zXh/6kXh/69Xh/6BXhe:CNxkbO
Malware Config
Extracted
vjw0rm
http://50.114.32.155:7974
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 8 1136 WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2148 chrome.exe 2148 chrome.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe Token: SeShutdownPrivilege 2148 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe 2148 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1136 wrote to memory of 2148 1136 WScript.exe 28 PID 1136 wrote to memory of 2148 1136 WScript.exe 28 PID 1136 wrote to memory of 2148 1136 WScript.exe 28 PID 2148 wrote to memory of 2476 2148 chrome.exe 29 PID 2148 wrote to memory of 2476 2148 chrome.exe 29 PID 2148 wrote to memory of 2476 2148 chrome.exe 29 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2884 2148 chrome.exe 31 PID 2148 wrote to memory of 2716 2148 chrome.exe 32 PID 2148 wrote to memory of 2716 2148 chrome.exe 32 PID 2148 wrote to memory of 2716 2148 chrome.exe 32 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33 PID 2148 wrote to memory of 1772 2148 chrome.exe 33
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Income tax return for Dircon Construction LLC.wsf"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://bit.ly/3QTQCiJ2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6719758,0x7fef6719768,0x7fef67197783⤵PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1240,i,4060548572722554896,11939475417930251096,131072 /prefetch:23⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1240,i,4060548572722554896,11939475417930251096,131072 /prefetch:83⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1240,i,4060548572722554896,11939475417930251096,131072 /prefetch:83⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1240,i,4060548572722554896,11939475417930251096,131072 /prefetch:13⤵PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2320 --field-trial-handle=1240,i,4060548572722554896,11939475417930251096,131072 /prefetch:13⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1336 --field-trial-handle=1240,i,4060548572722554896,11939475417930251096,131072 /prefetch:23⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3280 --field-trial-handle=1240,i,4060548572722554896,11939475417930251096,131072 /prefetch:13⤵PID:1784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3684 --field-trial-handle=1240,i,4060548572722554896,11939475417930251096,131072 /prefetch:83⤵PID:2520
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD568fcd66e25b58325d07c28449d997e33
SHA1d2cdc7a98e2fd9914bd03c84815cdc48ae546b08
SHA25649d0b4975ffc78bce44589e8e459dcb8160c7d0e9b94458aff37d533c63123ee
SHA512a9d5a30aed63ab4823c570077267eee701b3abdbb568e1381dbd5a0ad8eb093da2da9f66784a3e26bf3db80113986840fd6b4e4f2d53e950c3e5b64eb845b1f3
-
Filesize
4KB
MD5de958ed61fd0f3a08a0f2eeb8ad30157
SHA1e7da663c4c3cf45a804f5d633c982fc6bc7677c3
SHA25654269ba23fc8223986c96fa6d97d8280f77cd0c743f0dc5e6468f58eb1465c27
SHA5129ab1f82b402cc2001f9dc25c48d75fb4ef12939849bff66836d77ade5358832bfc985101cd1e31c6a58d603955cb8cf4c37d6ed2aec03c7be24a1698e7769ed2
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf