98e0c1e5d2e8e25ff99029d2f76a45a1b320c8cf3349df45d02dcd4070c0f49f

Resubmissions

13/09/2024, 13:59

240913-ragg2atdnf8

13/09/2024, 13:55

240913-q77vtatcqc8

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
locky sample/document_copy.js
Size 5KB
Sample240913-ragg2atdnf
SHA256 23e0e6edffc78a82ccef3cb055fda745013fde6feee5356f94715f41b2640453
MD5 5e13c906031221b202a833300d8a28b0
SHA1 72dea769a852776c87737bca07d4b8a4effa1af2
SHA512 793075b0f7e23686744730a3a580dc9429d3477334c708881189cc60329a70aaacd422569cd8be1bae0efe8f5875e348077da0f30c7e5aee21b4ca7bbaa59006
SSDEEP 96:OmMfGfr/O+hD6VxDNi4VHTBibX3CGKH8oCQaNwDgKM:OX+fr/O5VdI4VGX3CGKc+aaD0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	4552	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	wscript.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4552	3124	wscript.exe	83
PID 3124 wrote to memory of 4552	3124	wscript.exe	83

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\locky sample\document_copy.js"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\saveToFile.js"
  2⤵
  - Blocklisted process makes network request
  PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

S5G64114Gt.exe

Path C:\Users\Admin\AppData\Local\Temp\S5G64114Gt.exe
Size 62KB
SHA256 ba7973c4ed04ce1641e317f252f940c7ae9ccced42e9b928b28e7a738c1598a9
MD5 5f72e03e517f8e8f8cdd39f055812ea3
SHA1 9bf9f2fec7fcd01fe42934a940ad5910e75facb3
SHA512 b38f7f27c745c680b7207e0eb9a9a7830bfa46dfaaf55414d4dded8cf9dcc8d69d43f8542b6a526a76ddf4065c26b07b1315b5cd9d600ad59c9531d8e5212334
SSDEEP 1536:zkb70NnfRcO/+DDnzapeXmrR/f8A1zHVnIfHXg9ARTcyhApk:zkb70NnfP+DqnrR/F1zHVnoHXg9hyhqk
MD5 SHA1 SHA512 SSDEEP

Submit Download

saveToFile.js

Path C:\Users\Admin\AppData\Local\Temp\saveToFile.js
Size 1KB
SHA256 c9c864a14b489488afea1daf83bb6d631e94f0bc438e2a579ade1504db98d457
MD5 0f89975a9f7324f0a86bd9a762854062
SHA1 41c6af8fcd7f9dc324b83301ca4d2fadc0c972c8
SHA512 44dfb8d51ad07f5186d0233f79d6af8446a1d57731e7a0c67eb1093cbe5a2dec62ea183ff319991d93d2f994392958c5e6a30969a9aa9406584059f448a4b28b
MD5 SHA1 SHA512