f0018e9ee52604745ab35648d582debe47b01e73fdd86ebd9a08c513c2206e39

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ПАО «Группа Компаний ПИК» подробности заказа.js
Size

6KB
MD5

41a7eca4bffa6a286f47a0ff9b96d153
SHA1

eab7b5c4bd2d4087d03a1219f0827496f02fbb72
SHA256

eb81490c72ee724acace8b5bcfa8c20a95b53da6f29b9126456ea438bbe65331
SHA512

47f520459faaed8642d27a3b56c451ed478b2aa60ca1d5e0ce325b12bd27c93fad96d1554bb08b00f37ec878ad4e99bc0a3976d3ac638de2a7f89dd4bb9d7baf
SSDEEP

192:fyjM5NfQGUNp+thIqaAxtzPeWEusrplXd847YYe:KjM5NRvIRiBx0rmFYe

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
4	116	wscript.exe
7	116	wscript.exe
9	116	wscript.exe
30	116	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	wscript.exe

Deletes itself 1 IoCs

pid	Process
116	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1936	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 2532	116	wscript.exe	93
PID 116 wrote to memory of 2532	116	wscript.exe	93

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\ПАО «Группа Компаний ПИК» подробности заказа.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\rad52B99.tmp
  2⤵
  - Modifies registry class
  PID:2532

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rad52B99.tmp

Filesize
1KB

MD5
45a3a716a98e4cc9af47a5cf22f49301

SHA1
adf900e15303e2246bf688914e620e9dea84e9b9

SHA256
9f9721db1483fb16a1f826baf34a41b174016ba63bde8709ea2824ac2930aedd

SHA512
97e80242c2675e7a63b49332708436955ac21ef917cc07154b4979f3f441b9e5fec9049bad34282de1e2fb30a8b78ea2e80f32bd4c1b3f9d380d913613c1368b

Download Submit