a6eb5df0aa74bbf113e867adf46fc4e227fb72137d4bc5f9359cef4e34cf25ef

Analysis

max time kernel
84s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2023, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
allegato_358.js
Size 4KB
Sample231127-ldppxsff64
SHA256 a6eb5df0aa74bbf113e867adf46fc4e227fb72137d4bc5f9359cef4e34cf25ef
MD5 486966649f3c23ac0af991866f623014
SHA1 4fa37658241b43deea9b083233574ecfdaa60708
SHA512 55f420a44d992926072b132fc0359573f3ca7290b7f4a3189178bbba004cbf6bb4a33801b789a49654f5ed8066ce5a10a8ce70fcbcddd769c7853fa302c1a367
SSDEEP 96:2Qpt7DKtY32vKtkNojvidRsJ43mAmhyjCg8DSW5Rs5Su/byeY2jHP:7itlvw5ORsJ4NSICNDSW5LsH9jHP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	3888	wscript.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	wscript.exe

Deletes itself 1 IoCs

pid	Process
3888	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
5116	GY_tool.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 5116	3888	wscript.exe	86
PID 3888 wrote to memory of 5116	3888	wscript.exe	86

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\allegato_358.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Users\Admin\AppData\Local\Temp\GY_tool.exe
  "C:\Users\Admin\AppData\Local\Temp\GY_tool.exe"
  2⤵
  - Executes dropped EXE
  PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GY_tool.exe

Path C:\Users\Admin\AppData\Local\Temp\GY_tool.exe
Size 1.1MB
SHA256 d3bb0fed8b90aed93809d285139d34885642f05090f31c227453d21fef4c170d
MD5 760e2f767503e36bf1553a48ec597713
SHA1 b04c35dc7b669ba3dc3dde444c19991bd2e1a493
SHA512 951d877215b51014e66499d1626d2c63a84f4d8f4bdc35fe3fe9b0c449139c9a4eb096b05793ec2b85864fcc55691a9420b89f07d17d9ef6f04293f987b1a0b6
SSDEEP 24576:R1FvXWeilJJzhVN/XAfsCTv3wbodhYBT6jBDuOIAxsTbtC2:R1tXWeilJJdVN/AUifYBT6jDxCZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GY_tool.exe

Path C:\Users\Admin\AppData\Local\Temp\GY_tool.exe
Size 1.1MB
SHA256 d3bb0fed8b90aed93809d285139d34885642f05090f31c227453d21fef4c170d
MD5 760e2f767503e36bf1553a48ec597713
SHA1 b04c35dc7b669ba3dc3dde444c19991bd2e1a493
SHA512 951d877215b51014e66499d1626d2c63a84f4d8f4bdc35fe3fe9b0c449139c9a4eb096b05793ec2b85864fcc55691a9420b89f07d17d9ef6f04293f987b1a0b6
SSDEEP 24576:R1FvXWeilJJzhVN/XAfsCTv3wbodhYBT6jBDuOIAxsTbtC2:R1tXWeilJJdVN/AUifYBT6jDxCZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GY_tool.exe

Path C:\Users\Admin\AppData\Local\Temp\GY_tool.exe
Size 1.1MB
SHA256 d3bb0fed8b90aed93809d285139d34885642f05090f31c227453d21fef4c170d
MD5 760e2f767503e36bf1553a48ec597713
SHA1 b04c35dc7b669ba3dc3dde444c19991bd2e1a493
SHA512 951d877215b51014e66499d1626d2c63a84f4d8f4bdc35fe3fe9b0c449139c9a4eb096b05793ec2b85864fcc55691a9420b89f07d17d9ef6f04293f987b1a0b6
SSDEEP 24576:R1FvXWeilJJzhVN/XAfsCTv3wbodhYBT6jBDuOIAxsTbtC2:R1tXWeilJJdVN/AUifYBT6jDxCZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads