Overview
overview
10Static
static
1FACTURA_1714631916.js
windows7-x64
10FACTURA_1714631916.js
windows10-2004-x64
10FACTURA_1478723101.js
windows7-x64
10FACTURA_1478723101.js
windows10-2004-x64
10FACTURA_3104517939.js
windows7-x64
10FACTURA_3104517939.js
windows10-2004-x64
10FACTURA_50862162.js
windows7-x64
10FACTURA_50862162.js
windows10-2004-x64
10PDF20218238767362.js
windows7-x64
10PDF20218238767362.js
windows10-2004-x64
10FACTURA_1324819148.js
windows7-x64
10FACTURA_1324819148.js
windows10-2004-x64
10PDF247791026727441.js
windows7-x64
10PDF247791026727441.js
windows10-2004-x64
101258293779...be.zip
windows7-x64
11258293779...be.zip
windows10-2004-x64
11258293779...d8.zip
windows7-x64
11258293779...d8.zip
windows10-2004-x64
11258293779...22.zip
windows7-x64
11258293779...22.zip
windows10-2004-x64
11258293779...af.zip
windows7-x64
11258293779...af.zip
windows10-2004-x64
11258293779...6b.zip
windows7-x64
11258293779...6b.zip
windows10-2004-x64
11258293779...0b.zip
windows7-x64
11258293779...0b.zip
windows10-2004-x64
11258293779...25.zip
windows7-x64
11258293779...25.zip
windows10-2004-x64
11258293779...13.zip
windows7-x64
11258293779...13.zip
windows10-2004-x64
11258293779...e2.zip
windows7-x64
11258293779...e2.zip
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2023, 11:04
Static task
static1
Behavioral task
behavioral1
Sample
FACTURA_1714631916.js
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
FACTURA_1714631916.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
FACTURA_1478723101.js
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
FACTURA_1478723101.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
FACTURA_3104517939.js
Resource
win7-20231025-en
Behavioral task
behavioral6
Sample
FACTURA_3104517939.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
FACTURA_50862162.js
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
FACTURA_50862162.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
PDF20218238767362.js
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
PDF20218238767362.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
FACTURA_1324819148.js
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
FACTURA_1324819148.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
PDF247791026727441.js
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
PDF247791026727441.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral15
Sample
12582937793/b88e361f5db949317650956480502f6391359798fd85c0341c8c43c30fc361be.zip
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
12582937793/b88e361f5db949317650956480502f6391359798fd85c0341c8c43c30fc361be.zip
Resource
win10v2004-20231023-en
Behavioral task
behavioral17
Sample
12582937793/c1158c88f7951a14ff2436e679719e1b57d56002f1050b340b1fdd9bf37ee4d8.zip
Resource
win7-20231023-en
Behavioral task
behavioral18
Sample
12582937793/c1158c88f7951a14ff2436e679719e1b57d56002f1050b340b1fdd9bf37ee4d8.zip
Resource
win10v2004-20231020-en
Behavioral task
behavioral19
Sample
12582937793/ccd10d0c856a95beeffdd47f9e6530e71f23b2f3700c6fa609acfe262d5f1522.zip
Resource
win7-20231020-en
Behavioral task
behavioral20
Sample
12582937793/ccd10d0c856a95beeffdd47f9e6530e71f23b2f3700c6fa609acfe262d5f1522.zip
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
12582937793/cea14b7d1bffe66e3139930602537416b723f2b685e08d5680fc677c5730d4af.zip
Resource
win7-20231025-en
Behavioral task
behavioral22
Sample
12582937793/cea14b7d1bffe66e3139930602537416b723f2b685e08d5680fc677c5730d4af.zip
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
12582937793/cfd9efc4bcffd83c78da7165035918144b394a79b2fb60305f8993e35ee2986b.zip
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
12582937793/cfd9efc4bcffd83c78da7165035918144b394a79b2fb60305f8993e35ee2986b.zip
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
12582937793/d0fd7e32bf5ce2e1781ad484e03644d58122912eb5b88de3ffbf3fa12d09c80b.zip
Resource
win7-20231023-en
Behavioral task
behavioral26
Sample
12582937793/d0fd7e32bf5ce2e1781ad484e03644d58122912eb5b88de3ffbf3fa12d09c80b.zip
Resource
win10v2004-20231025-en
Behavioral task
behavioral27
Sample
12582937793/da6db77248718ea9cb22ea8b99d3030aa2838d241fdd2f64dbaaf60b02903f25.zip
Resource
win7-20231023-en
Behavioral task
behavioral28
Sample
12582937793/da6db77248718ea9cb22ea8b99d3030aa2838d241fdd2f64dbaaf60b02903f25.zip
Resource
win10v2004-20231020-en
Behavioral task
behavioral29
Sample
12582937793/da9a74db58c63c627e43a42e4b1f368cd13a34795e185414283393b9a4dcb813.zip
Resource
win7-20231020-en
Behavioral task
behavioral30
Sample
12582937793/da9a74db58c63c627e43a42e4b1f368cd13a34795e185414283393b9a4dcb813.zip
Resource
win10v2004-20231020-en
Behavioral task
behavioral31
Sample
12582937793/df041e0c1f5e2a8cbdf2b7c77c21cc8892a010172ee77ce9b1f63629e0fd9ee2.zip
Resource
win7-20231023-en
Behavioral task
behavioral32
Sample
12582937793/df041e0c1f5e2a8cbdf2b7c77c21cc8892a010172ee77ce9b1f63629e0fd9ee2.zip
Resource
win10v2004-20231023-en
General
-
Target
FACTURA_3104517939.js
-
Size
5.8MB
-
MD5
327a373e0e25a1c2092382a4afae2e08
-
SHA1
7ddd453a6bf635d46241700a34e51b8dba8f0d6c
-
SHA256
35843ae0b4d7d0b3839eebba3feb980ee9b5f583e0b778624d593d29741fa2ee
-
SHA512
b826d094b1dfd83290920f11037a5b09b1a4f2bd5def4752a8848fd317acc75a36ff8f3d08c3d35f6a00b0d591f4b63b838b6d351efaa8476b502796d558daeb
-
SSDEEP
24576:deQRxTsUSP8m3z+YOxemo3gD8D3xQZIw57xOfRP/Qjuzwn57g4P0PhFsLpIq2vEn:TRXmjuQ4uRPRMQRvrjrqn3W14UbU1
Malware Config
Extracted
strela
193.109.85.77
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation wscript.exe -
Loads dropped DLL 1 IoCs
pid Process 1352 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 428 wrote to memory of 116 428 wscript.exe 86 PID 428 wrote to memory of 116 428 wscript.exe 86 PID 116 wrote to memory of 3064 116 cmd.exe 92 PID 116 wrote to memory of 3064 116 cmd.exe 92 PID 116 wrote to memory of 1456 116 cmd.exe 93 PID 116 wrote to memory of 1456 116 cmd.exe 93 PID 116 wrote to memory of 1352 116 cmd.exe 94 PID 116 wrote to memory of 1352 116 cmd.exe 94
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\FACTURA_3104517939.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\FACTURA_3104517939.js" "C:\Users\Admin\AppData\Local\Temp\\synonymoussad.bat" && "C:\Users\Admin\AppData\Local\Temp\\synonymoussad.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\system32\findstr.exefindstr /V strangestriped ""C:\Users\Admin\AppData\Local\Temp\\synonymoussad.bat""3⤵PID:3064
-
-
C:\Windows\system32\certutil.execertutil -f -decode upsetbusy womanselection.dll3⤵PID:1456
-
-
C:\Windows\system32\regsvr32.exeregsvr32 womanselection.dll3⤵
- Loads dropped DLL
PID:1352
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD5327a373e0e25a1c2092382a4afae2e08
SHA17ddd453a6bf635d46241700a34e51b8dba8f0d6c
SHA25635843ae0b4d7d0b3839eebba3feb980ee9b5f583e0b778624d593d29741fa2ee
SHA512b826d094b1dfd83290920f11037a5b09b1a4f2bd5def4752a8848fd317acc75a36ff8f3d08c3d35f6a00b0d591f4b63b838b6d351efaa8476b502796d558daeb
-
Filesize
5.8MB
MD5327a373e0e25a1c2092382a4afae2e08
SHA17ddd453a6bf635d46241700a34e51b8dba8f0d6c
SHA25635843ae0b4d7d0b3839eebba3feb980ee9b5f583e0b778624d593d29741fa2ee
SHA512b826d094b1dfd83290920f11037a5b09b1a4f2bd5def4752a8848fd317acc75a36ff8f3d08c3d35f6a00b0d591f4b63b838b6d351efaa8476b502796d558daeb
-
Filesize
5.7MB
MD5f183d3d74b21c168d931f48c372bf431
SHA1864b7511699f642d0f0662be59c6154faf89fa10
SHA256e4064513a6c8a3a27453d81903c55ae55f33eae855339473ff1bc5b6969e235e
SHA51292db029907e42fd3a236c1860545907c0376aa5f1f68eff6671632271736ea14ec78fc16184317c3d8f990fdcd8d84555d86e92c2291822af66fd96072440311
-
Filesize
4.2MB
MD5477f1313691864a4176c1666640dcccf
SHA139d05d2753ab358bf284ab43f32502aa11b35976
SHA25648d1c1200b9f8b22be670df8c8b1c50237b867f12986338255fd72bf973b5a17
SHA512d1edd127cfab80d35275c2230f2b52e7fcc3fa449e6d0ed273246fed6d5573855949fa504ce54c8adc5cb31831d33bb54ec0024473381994cf5f78f18981642b
-
Filesize
4.2MB
MD5477f1313691864a4176c1666640dcccf
SHA139d05d2753ab358bf284ab43f32502aa11b35976
SHA25648d1c1200b9f8b22be670df8c8b1c50237b867f12986338255fd72bf973b5a17
SHA512d1edd127cfab80d35275c2230f2b52e7fcc3fa449e6d0ed273246fed6d5573855949fa504ce54c8adc5cb31831d33bb54ec0024473381994cf5f78f18981642b