Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 16:15
Static task
static1
Behavioral task
behavioral1
Sample
LPO-9108993JS.js
Resource
win7-20240508-en
General
-
Target
LPO-9108993JS.js
-
Size
443KB
-
MD5
cdc0ff3b2e6bd8e1a0d09ff010c2c899
-
SHA1
e15ab2d20673e273eb9698894c9f1ef07a893999
-
SHA256
f224a2adc08aef0c0fc1899d4ba8aa52e3c608ef2b294dec6d72590dfcb91614
-
SHA512
787ea82b4404ff50f77f18b36f60071551e8a80810e52d92fac6c89e06baa66bb3d0f09970c5a043273416a3aa92b99b74ae8e2a1f6d66f30c1bd92a282deea9
-
SSDEEP
6144:ZQOOkQsu5kVH5fRAZmyUzxDRqns5D9rmqJ1UnYUB48xM91Y1WziypzkAkaM1kxKm:HVuGZq6xDk8H1cYm48xMYCkbprC
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zvthscrgkj.txt java.exe -
Loads dropped DLL 1 IoCs
pid Process 1832 java.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3492 icacls.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zvthscrgkj = "\"C:\\Users\\Admin\\AppData\\Roaming\\zvthscrgkj.txt\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zvthscrgkj = "\"C:\\Users\\Admin\\AppData\\Roaming\\zvthscrgkj.txt\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ip-api.com -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1380 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5100 WMIC.exe Token: SeSecurityPrivilege 5100 WMIC.exe Token: SeTakeOwnershipPrivilege 5100 WMIC.exe Token: SeLoadDriverPrivilege 5100 WMIC.exe Token: SeSystemProfilePrivilege 5100 WMIC.exe Token: SeSystemtimePrivilege 5100 WMIC.exe Token: SeProfSingleProcessPrivilege 5100 WMIC.exe Token: SeIncBasePriorityPrivilege 5100 WMIC.exe Token: SeCreatePagefilePrivilege 5100 WMIC.exe Token: SeBackupPrivilege 5100 WMIC.exe Token: SeRestorePrivilege 5100 WMIC.exe Token: SeShutdownPrivilege 5100 WMIC.exe Token: SeDebugPrivilege 5100 WMIC.exe Token: SeSystemEnvironmentPrivilege 5100 WMIC.exe Token: SeRemoteShutdownPrivilege 5100 WMIC.exe Token: SeUndockPrivilege 5100 WMIC.exe Token: SeManageVolumePrivilege 5100 WMIC.exe Token: 33 5100 WMIC.exe Token: 34 5100 WMIC.exe Token: 35 5100 WMIC.exe Token: 36 5100 WMIC.exe Token: SeIncreaseQuotaPrivilege 5100 WMIC.exe Token: SeSecurityPrivilege 5100 WMIC.exe Token: SeTakeOwnershipPrivilege 5100 WMIC.exe Token: SeLoadDriverPrivilege 5100 WMIC.exe Token: SeSystemProfilePrivilege 5100 WMIC.exe Token: SeSystemtimePrivilege 5100 WMIC.exe Token: SeProfSingleProcessPrivilege 5100 WMIC.exe Token: SeIncBasePriorityPrivilege 5100 WMIC.exe Token: SeCreatePagefilePrivilege 5100 WMIC.exe Token: SeBackupPrivilege 5100 WMIC.exe Token: SeRestorePrivilege 5100 WMIC.exe Token: SeShutdownPrivilege 5100 WMIC.exe Token: SeDebugPrivilege 5100 WMIC.exe Token: SeSystemEnvironmentPrivilege 5100 WMIC.exe Token: SeRemoteShutdownPrivilege 5100 WMIC.exe Token: SeUndockPrivilege 5100 WMIC.exe Token: SeManageVolumePrivilege 5100 WMIC.exe Token: 33 5100 WMIC.exe Token: 34 5100 WMIC.exe Token: 35 5100 WMIC.exe Token: 36 5100 WMIC.exe Token: SeIncreaseQuotaPrivilege 2508 WMIC.exe Token: SeSecurityPrivilege 2508 WMIC.exe Token: SeTakeOwnershipPrivilege 2508 WMIC.exe Token: SeLoadDriverPrivilege 2508 WMIC.exe Token: SeSystemProfilePrivilege 2508 WMIC.exe Token: SeSystemtimePrivilege 2508 WMIC.exe Token: SeProfSingleProcessPrivilege 2508 WMIC.exe Token: SeIncBasePriorityPrivilege 2508 WMIC.exe Token: SeCreatePagefilePrivilege 2508 WMIC.exe Token: SeBackupPrivilege 2508 WMIC.exe Token: SeRestorePrivilege 2508 WMIC.exe Token: SeShutdownPrivilege 2508 WMIC.exe Token: SeDebugPrivilege 2508 WMIC.exe Token: SeSystemEnvironmentPrivilege 2508 WMIC.exe Token: SeRemoteShutdownPrivilege 2508 WMIC.exe Token: SeUndockPrivilege 2508 WMIC.exe Token: SeManageVolumePrivilege 2508 WMIC.exe Token: 33 2508 WMIC.exe Token: 34 2508 WMIC.exe Token: 35 2508 WMIC.exe Token: 36 2508 WMIC.exe Token: SeIncreaseQuotaPrivilege 2508 WMIC.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1328 wrote to memory of 2748 1328 wscript.exe 81 PID 1328 wrote to memory of 2748 1328 wscript.exe 81 PID 2748 wrote to memory of 3492 2748 javaw.exe 82 PID 2748 wrote to memory of 3492 2748 javaw.exe 82 PID 2748 wrote to memory of 4036 2748 javaw.exe 84 PID 2748 wrote to memory of 4036 2748 javaw.exe 84 PID 4036 wrote to memory of 4048 4036 wscript.exe 85 PID 4036 wrote to memory of 4048 4036 wscript.exe 85 PID 4048 wrote to memory of 4352 4048 javaw.exe 86 PID 4048 wrote to memory of 4352 4048 javaw.exe 86 PID 4352 wrote to memory of 4476 4352 java.exe 88 PID 4352 wrote to memory of 4476 4352 java.exe 88 PID 4352 wrote to memory of 1832 4352 java.exe 89 PID 4352 wrote to memory of 1832 4352 java.exe 89 PID 4476 wrote to memory of 1380 4476 cmd.exe 92 PID 4476 wrote to memory of 1380 4476 cmd.exe 92 PID 1832 wrote to memory of 4584 1832 java.exe 93 PID 1832 wrote to memory of 4584 1832 java.exe 93 PID 4584 wrote to memory of 5100 4584 cmd.exe 95 PID 4584 wrote to memory of 5100 4584 cmd.exe 95 PID 1832 wrote to memory of 3356 1832 java.exe 97 PID 1832 wrote to memory of 3356 1832 java.exe 97 PID 3356 wrote to memory of 2508 3356 cmd.exe 99 PID 3356 wrote to memory of 2508 3356 cmd.exe 99 PID 1832 wrote to memory of 3904 1832 java.exe 100 PID 1832 wrote to memory of 3904 1832 java.exe 100 PID 3904 wrote to memory of 3616 3904 cmd.exe 102 PID 3904 wrote to memory of 3616 3904 cmd.exe 102 PID 1832 wrote to memory of 4156 1832 java.exe 103 PID 1832 wrote to memory of 4156 1832 java.exe 103 PID 4156 wrote to memory of 2936 4156 cmd.exe 105 PID 4156 wrote to memory of 2936 4156 cmd.exe 105 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\LPO-9108993JS.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\azdjqwmz.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
PID:3492
-
-
C:\Windows\SYSTEM32\wscript.exewscript C:\Users\Admin\pnjtiaccyf.js3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\zvthscrgkj.txt"4⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\zvthscrgkj.txt"5⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\zvthscrgkj.txt"6⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\zvthscrgkj.txt"7⤵
- Creates scheduled task(s)
PID:1380
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\zvthscrgkj.txt"6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"7⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list8⤵
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"7⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list8⤵
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"7⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list8⤵PID:3616
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"7⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list8⤵PID:2936
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD51ee964a95bc8f086a24ded3b0e3348f7
SHA13d0bda8c389943c610dbd82df6c3bbe96b1956e6
SHA256145972f8f2e86d6293ec67bd6dd810e67ffbb8261629aae806da3d8ef9a95799
SHA51273f3b8d726d489372832051b85cdf1d124b9e9645ed370c5af4609f383a407565b91601eb6e81af83666f9ed209c7bb21df06ba4b09dd33b06ef74a1b3aaf36a
-
Filesize
241KB
MD5e02979ecd43bcc9061eb2b494ab5af50
SHA13122ac0e751660f646c73b10c4f79685aa65c545
SHA256a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a
SHA5121e6f7dcb6a557c9b896412a48dd017c16f7a52fa2b9ab513593c9ecd118e86083979821ca7a3e2f098ee349200c823c759cec6599740dd391cb5f354dc29b372
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2539840389-1261165778-1087677076-1000\83aa4cc77f591dfc2374580bbd95f6ba_468f6343-c0e6-4931-9703-30c6539573cb
Filesize45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
Filesize
219KB
MD5dc460eff6b011dad319db62115365f3a
SHA1112909f254ae16361a6f3dfe757f45896fa8f522
SHA2568d1f7af142e64bcc42117302ce5c20a1e8cce37485f5f8948f006924498cd997
SHA512d8ed4c60a35a8be32cd391c4c356f53bedbb2f59b20061f01a0aa751091fcb367799ffab266ad9ca33ef677fe12d30811991b4641c4519aeea073a095cc74d18
-
Filesize
164KB
MD5263238ba3312613146a92ecfad5f5abb
SHA157d076f1deb30314bdef4d7e4795068957c8c0d0
SHA2564a464631cf3f7f3261f79fc443dd63d0d205806077e33e9ea1477134d2f7c723
SHA512baaa069e01cf004eec72569fb49312dcf2b1bdac304b6c2e003a926f052c71708e2e704a14e81fbdaabbb01067c61f295bca1c97dfd2fef8ebc2b055eb12f9c4
-
Filesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
Filesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
Filesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
Filesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
Filesize
347KB
MD54ab0c7385d9202a8aed07e0086d83711
SHA1987d7102a8585fde7412554732d7974159e007fa
SHA2565eb64fbe30ab5c8d68fd358f31f9f3cf9c2cb52032a1736a4b327a3d02d8bd0a
SHA512c53ffb22e9dba04607c6648c4b6dd3195eaedbf73ce6b0f065aa116db1e6188b5096b53f281e02486e0b0f8f7e407870c050465902566f4701ce511ed4631682