Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 01:25
Static task
static1
Behavioral task
behavioral1
Sample
677e9d60fdfd7b374d9d3f764f4ef4a15924779990f83d221c8957a51715b470.js
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
General
-
Target
677e9d60fdfd7b374d9d3f764f4ef4a15924779990f83d221c8957a51715b470.js
-
Size
1.1MB
-
MD5
b76091245411a29ba40c3ece08e76490
-
SHA1
f88efc6a3ff16cfe0b82f2c3068f2f113a083510
-
SHA256
677e9d60fdfd7b374d9d3f764f4ef4a15924779990f83d221c8957a51715b470
-
SHA512
23ba586f4ebb15d608af25e0b1aee919b6d40f8044fdbd97d4d5277c0aaf48649232b91a2911e4d225655af9544ad4a1c1a934d63821e1fde12d17942a836d99
-
SSDEEP
24576:nwuZZ9D0v/d7C4t0kQhlTqtxQatGnE2xmYhdTz:wsHD03d7C4trQhlTQxTtGnzhdTz
Malware Config
Signatures
-
Blocklisted process makes network request 59 IoCs
flow pid Process 3 4028 msiexec.exe 24 2940 rundll32.exe 26 2940 rundll32.exe 28 2940 rundll32.exe 32 2940 rundll32.exe 34 2940 rundll32.exe 36 2940 rundll32.exe 44 2940 rundll32.exe 46 2940 rundll32.exe 47 2940 rundll32.exe 48 2940 rundll32.exe 50 2940 rundll32.exe 51 2940 rundll32.exe 52 2940 rundll32.exe 53 2940 rundll32.exe 63 2940 rundll32.exe 67 2940 rundll32.exe 68 2940 rundll32.exe 69 2940 rundll32.exe 70 2940 rundll32.exe 71 2940 rundll32.exe 72 2940 rundll32.exe 73 2940 rundll32.exe 74 2940 rundll32.exe 75 2940 rundll32.exe 80 2940 rundll32.exe 81 2940 rundll32.exe 84 2940 rundll32.exe 86 2940 rundll32.exe 87 2940 rundll32.exe 88 2940 rundll32.exe 89 2940 rundll32.exe 90 2940 rundll32.exe 91 2940 rundll32.exe 92 2940 rundll32.exe 93 2940 rundll32.exe 94 2940 rundll32.exe 97 2940 rundll32.exe 98 2940 rundll32.exe 99 2940 rundll32.exe 111 2940 rundll32.exe 113 2940 rundll32.exe 114 2940 rundll32.exe 115 2940 rundll32.exe 116 2940 rundll32.exe 117 2940 rundll32.exe 118 2940 rundll32.exe 119 2940 rundll32.exe 120 2940 rundll32.exe 121 2940 rundll32.exe 122 2940 rundll32.exe 123 2940 rundll32.exe 124 2940 rundll32.exe 125 2940 rundll32.exe 126 2940 rundll32.exe 127 2940 rundll32.exe 128 2940 rundll32.exe 129 2940 rundll32.exe 130 2940 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 688 MSID0B4.tmp -
Loads dropped DLL 5 IoCs
pid Process 3936 MsiExec.exe 3936 MsiExec.exe 3936 MsiExec.exe 3936 MsiExec.exe 2940 rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSICDA1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICF0A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSID036.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID0B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC813.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSICF97.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICFE7.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSID0B4.tmp -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4028 msiexec.exe 4028 msiexec.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe 2940 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 1132 wscript.exe Token: SeIncreaseQuotaPrivilege 1132 wscript.exe Token: SeSecurityPrivilege 4028 msiexec.exe Token: SeCreateTokenPrivilege 1132 wscript.exe Token: SeAssignPrimaryTokenPrivilege 1132 wscript.exe Token: SeLockMemoryPrivilege 1132 wscript.exe Token: SeIncreaseQuotaPrivilege 1132 wscript.exe Token: SeMachineAccountPrivilege 1132 wscript.exe Token: SeTcbPrivilege 1132 wscript.exe Token: SeSecurityPrivilege 1132 wscript.exe Token: SeTakeOwnershipPrivilege 1132 wscript.exe Token: SeLoadDriverPrivilege 1132 wscript.exe Token: SeSystemProfilePrivilege 1132 wscript.exe Token: SeSystemtimePrivilege 1132 wscript.exe Token: SeProfSingleProcessPrivilege 1132 wscript.exe Token: SeIncBasePriorityPrivilege 1132 wscript.exe Token: SeCreatePagefilePrivilege 1132 wscript.exe Token: SeCreatePermanentPrivilege 1132 wscript.exe Token: SeBackupPrivilege 1132 wscript.exe Token: SeRestorePrivilege 1132 wscript.exe Token: SeShutdownPrivilege 1132 wscript.exe Token: SeDebugPrivilege 1132 wscript.exe Token: SeAuditPrivilege 1132 wscript.exe Token: SeSystemEnvironmentPrivilege 1132 wscript.exe Token: SeChangeNotifyPrivilege 1132 wscript.exe Token: SeRemoteShutdownPrivilege 1132 wscript.exe Token: SeUndockPrivilege 1132 wscript.exe Token: SeSyncAgentPrivilege 1132 wscript.exe Token: SeEnableDelegationPrivilege 1132 wscript.exe Token: SeManageVolumePrivilege 1132 wscript.exe Token: SeImpersonatePrivilege 1132 wscript.exe Token: SeCreateGlobalPrivilege 1132 wscript.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4028 wrote to memory of 3936 4028 msiexec.exe 89 PID 4028 wrote to memory of 3936 4028 msiexec.exe 89 PID 4028 wrote to memory of 3936 4028 msiexec.exe 89 PID 4028 wrote to memory of 688 4028 msiexec.exe 90 PID 4028 wrote to memory of 688 4028 msiexec.exe 90 PID 4028 wrote to memory of 688 4028 msiexec.exe 90
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\677e9d60fdfd7b374d9d3f764f4ef4a15924779990f83d221c8957a51715b470.js1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6AD4A27227CEC98B7F464E1FA44A79802⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3936
-
-
C:\Windows\Installer\MSID0B4.tmp"C:\Windows\Installer\MSID0B4.tmp" /DontWait C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\x64_stealth.dll, clBuildProgram2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:688
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\x64_stealth.dll, clBuildProgram1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54af24469b4a48654df9f4b3960980509
SHA1f433ccc1e6298ee656f7dda8800c66a1e4d6e4d2
SHA2566eb292a20c9e526a38e4b7a5725e0cd814f4023004c7e18a28f48172e28f2afa
SHA5121e614d950a3b2182320c40c0a61fe1705a95be5be68ac32bf590e5974aef3cfce6baaaa14ed1281ffc683d479c5a779aadb5dd773e40f84964303aa2bc4320e7
-
Filesize
1.7MB
MD54d343ce28a572f1bca64473232a039a9
SHA1aaf14040d4ee2a03d48d961f7d70970d4513237f
SHA2565c7a3bd2baa8303354d8098b8d5961f111e467002bb0c6fee120825b32798228
SHA512bd723a89aef1778fff3af72459b59aa2316cb010b290e9d5679c8e72959db70086d65ee0ef16e8cb45349be04b3ae9daeb53b63defbebfac8452a97ce46da814
-
Filesize
2.1MB
MD5d75db138a6519ace7795ba35ea62a498
SHA1dc8ec40f846dd55be5661d43a80acb4d442f6cd3
SHA2561b9e17bfbd292075956cc2006983f91e17aed94ebbb0fb370bf83d23b14289fa
SHA512eeef3b0620cfbd332110b8123e2548b8b6a6b4d2259932463755aae2569440a8807eed7a5b5274b9bb01cde7604bc7aeb560b606609d7fc885cd97621c9106c1
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04