bruteratel | 0d9d65a1f9c447584a022a866fed2399bf8b42e2a0087a786e87087bba1e18f1

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
submitted
03-10-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Document-20-18-07.js
Size

339KB
MD5

75e64bec47916e4860cb6b151fcbaed6
SHA1

0102db540317b48d319cfb5b3538e364ff2bac6b
SHA256

0d9d65a1f9c447584a022a866fed2399bf8b42e2a0087a786e87087bba1e18f1
SHA512

208d0b1239c531d34f3bba59a950cf0b791e85870c6cc4512327733010e02fb4b932d98ff13d40cb758636453ad3bdc84509a1c0778facf47a56ecb79a8daee7
SSDEEP

6144:TnOwLgNJEXMI/ptQxobwi+a0xPr4fTpJ2Ll29NOzWC22hFMPPr6wWHclWErffr+:q6gNJEXhBtmobwi+bMT2LlKOztPFmGHd

Score

10^/10

bruteratel backdoor discovery execution

Malware Config

Signatures

Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
backdoor bruteratel
Bruteratel family
bruteratel

Detect BruteRatel badger 3 IoCs

resource	yara_rule
behavioral1/memory/2268-149-0x0000000273F40000-0x0000000273F8A000-memory.dmp	family_bruteratel
behavioral1/memory/2268-146-0x0000000273F40000-0x0000000273F8A000-memory.dmp	family_bruteratel
behavioral1/memory/2268-165-0x0000000273F40000-0x0000000273F8A000-memory.dmp	family_bruteratel

Blocklisted process makes network request 64 IoCs

flow	pid	Process
3	2432	wscript.exe
5	2432	wscript.exe
8	1900	msiexec.exe
12	2268	rundll32.exe
14	2268	rundll32.exe
16	2268	rundll32.exe
18	2268	rundll32.exe
19	2268	rundll32.exe
20	2268	rundll32.exe
21	2268	rundll32.exe
22	2268	rundll32.exe
23	2268	rundll32.exe
24	2268	rundll32.exe
25	2268	rundll32.exe
26	2268	rundll32.exe
28	2268	rundll32.exe
30	2268	rundll32.exe
31	2268	rundll32.exe
32	2268	rundll32.exe
33	2268	rundll32.exe
34	2268	rundll32.exe
35	2268	rundll32.exe
36	2268	rundll32.exe
37	2268	rundll32.exe
38	2268	rundll32.exe
39	2268	rundll32.exe
40	2268	rundll32.exe
41	2268	rundll32.exe
42	2268	rundll32.exe
43	2268	rundll32.exe
44	2268	rundll32.exe
45	2268	rundll32.exe
46	2268	rundll32.exe
47	2268	rundll32.exe
48	2268	rundll32.exe
49	2268	rundll32.exe
54	2268	rundll32.exe
55	2268	rundll32.exe
56	2268	rundll32.exe
57	2268	rundll32.exe
58	2268	rundll32.exe
59	2268	rundll32.exe
60	2268	rundll32.exe
61	2268	rundll32.exe
62	2268	rundll32.exe
63	2268	rundll32.exe
64	2268	rundll32.exe
65	2268	rundll32.exe
66	2268	rundll32.exe
67	2268	rundll32.exe
68	2268	rundll32.exe
69	2268	rundll32.exe
70	2268	rundll32.exe
71	2268	rundll32.exe
72	2268	rundll32.exe
73	2268	rundll32.exe
74	2268	rundll32.exe
75	2268	rundll32.exe
76	2268	rundll32.exe
77	2268	rundll32.exe
78	2268	rundll32.exe
79	2268	rundll32.exe
80	2268	rundll32.exe
81	2268	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
548	MSIFCFB.tmp

Loads dropped DLL 11 IoCs

pid	Process
2200	MsiExec.exe
2200	MsiExec.exe
2200	MsiExec.exe
2384	rundll32.exe
2384	rundll32.exe
2384	rundll32.exe
2384	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIFA96.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCCA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCFB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76fb61.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF6FC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA19.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFAC6.tmp	msiexec.exe
File created	C:\Windows\Installer\f76fb61.ipi	msiexec.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIFCFB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	wscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	wscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	wscript.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1900	msiexec.exe
1900	msiexec.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2432	wscript.exe
Token: SeIncreaseQuotaPrivilege	2432	wscript.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeSecurityPrivilege	1900	msiexec.exe
Token: SeCreateTokenPrivilege	2432	wscript.exe
Token: SeAssignPrimaryTokenPrivilege	2432	wscript.exe
Token: SeLockMemoryPrivilege	2432	wscript.exe
Token: SeIncreaseQuotaPrivilege	2432	wscript.exe
Token: SeMachineAccountPrivilege	2432	wscript.exe
Token: SeTcbPrivilege	2432	wscript.exe
Token: SeSecurityPrivilege	2432	wscript.exe
Token: SeTakeOwnershipPrivilege	2432	wscript.exe
Token: SeLoadDriverPrivilege	2432	wscript.exe
Token: SeSystemProfilePrivilege	2432	wscript.exe
Token: SeSystemtimePrivilege	2432	wscript.exe
Token: SeProfSingleProcessPrivilege	2432	wscript.exe
Token: SeIncBasePriorityPrivilege	2432	wscript.exe
Token: SeCreatePagefilePrivilege	2432	wscript.exe
Token: SeCreatePermanentPrivilege	2432	wscript.exe
Token: SeBackupPrivilege	2432	wscript.exe
Token: SeRestorePrivilege	2432	wscript.exe
Token: SeShutdownPrivilege	2432	wscript.exe
Token: SeDebugPrivilege	2432	wscript.exe
Token: SeAuditPrivilege	2432	wscript.exe
Token: SeSystemEnvironmentPrivilege	2432	wscript.exe
Token: SeChangeNotifyPrivilege	2432	wscript.exe
Token: SeRemoteShutdownPrivilege	2432	wscript.exe
Token: SeUndockPrivilege	2432	wscript.exe
Token: SeSyncAgentPrivilege	2432	wscript.exe
Token: SeEnableDelegationPrivilege	2432	wscript.exe
Token: SeManageVolumePrivilege	2432	wscript.exe
Token: SeImpersonatePrivilege	2432	wscript.exe
Token: SeCreateGlobalPrivilege	2432	wscript.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2200	1900	msiexec.exe	32
PID 1900 wrote to memory of 2200	1900	msiexec.exe	32
PID 1900 wrote to memory of 2200	1900	msiexec.exe	32
PID 1900 wrote to memory of 2200	1900	msiexec.exe	32
PID 1900 wrote to memory of 2200	1900	msiexec.exe	32
PID 1900 wrote to memory of 2200	1900	msiexec.exe	32
PID 1900 wrote to memory of 2200	1900	msiexec.exe	32
PID 1900 wrote to memory of 548	1900	msiexec.exe	33
PID 1900 wrote to memory of 548	1900	msiexec.exe	33
PID 1900 wrote to memory of 548	1900	msiexec.exe	33
PID 1900 wrote to memory of 548	1900	msiexec.exe	33
PID 1900 wrote to memory of 548	1900	msiexec.exe	33
PID 1900 wrote to memory of 548	1900	msiexec.exe	33
PID 1900 wrote to memory of 548	1900	msiexec.exe	33
PID 2384 wrote to memory of 2268	2384	rundll32.exe	35
PID 2384 wrote to memory of 2268	2384	rundll32.exe	35
PID 2384 wrote to memory of 2268	2384	rundll32.exe	35
PID 2384 wrote to memory of 2268	2384	rundll32.exe	35

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Document-20-18-07.js
1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 89A5C2D0ACC7D6868627D7CEE10351B6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2200
- C:\Windows\Installer\MSIFCFB.tmp
  "C:\Windows\Installer\MSIFCFB.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\Admin\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:548

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76fb62.rbs

Filesize
1KB

MD5
a14634a719c80f92d16739bdfe956e75

SHA1
20bc0bcc3361626650b887dc74f74029b1f92543

SHA256
94ca56b77c8767ea6af52cd6b15135a4e822408e3d0f9d1d3a6b588b8cbbdfe7

SHA512
74f8307111d5441298630fd971aa02e648b8b493a63612bc645b860917b816af2625c00a81f7e3ae81209e77aaca93f717a01d957d0a4484f2e71686e15cd065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2363f10812d3b0fa9f839be295476a27

SHA1
18ba1e43fbb1a68b84a562be30a2fbb93fdd291f

SHA256
4ebf634fc49f832c46395a61b34d7e70995601776ca1cfdcc6387e7b6041e155

SHA512
042e1476ea50633d03602c5dfe6cb4b1c46f22864eb7817a9a60c4398e6d8fdbe0e9c4eff9a6a3b6a1884113a342cee63fe855b5e2bf00e166c1bf88addb5286

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA90.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB0F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\vierm_soft_x64.dll

Filesize
749KB

MD5
b1ca25f5bb4edd293b3711c77eb99a6f

SHA1
178bba8686ea329b884a652fe0f8a0ae0c53d367

SHA256
97a6331239d451d7dfe15bfe17de8b419df741ae68bacd440808f8b8d3f99b8a

SHA512
d5a282a8f81e117b79616c44a260d89c7fee06f4ac1387675bc79c3bd7599a5d49fbe3d8fb3d4d42eea81a17564abc2d42288bc2dc468d1b16ed633ba421b32d

Download Submit
C:\Windows\Installer\MSIF6FC.tmp

Filesize
1.6MB

MD5
3cb6b99b20930ac0dbadc10899dc511e

SHA1
570c4ab78cf4bb22b78aac215a4a79189d4fa9ed

SHA256
ea1792f689bfe5ad3597c7f877b66f9fcf80d732e5233293d52d374d50cab991

SHA512
aedf58ea01d59cce191cb9c0f83dbdbf7e3e8f049c764b577d6a957cb5229c50dda7ec6760ca43ad4dbdb085ae02b07bc818f69ca08373243019af6683e4931c

Download Submit
C:\Windows\Installer\MSIFA19.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIFCFB.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
memory/548-136-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2268-149-0x0000000273F40000-0x0000000273F8A000-memory.dmp

Filesize
296KB

Download
memory/2268-146-0x0000000273F40000-0x0000000273F8A000-memory.dmp

Filesize
296KB

Download
memory/2268-156-0x0000000001E40000-0x0000000001E8C000-memory.dmp

Filesize
304KB

Download
memory/2268-154-0x000007FEFD120000-0x000007FEFD18C000-memory.dmp

Filesize
432KB

Download
memory/2268-152-0x0000000076EA0000-0x0000000076FBF000-memory.dmp

Filesize
1.1MB

Download
memory/2268-150-0x00000000770C0000-0x0000000077269000-memory.dmp

Filesize
1.7MB

Download
memory/2268-165-0x0000000273F40000-0x0000000273F8A000-memory.dmp

Filesize
296KB

Download
memory/2268-147-0x0000000000340000-0x000000000037E000-memory.dmp

Filesize
248KB

Download
memory/2268-182-0x0000000001E40000-0x0000000001E8C000-memory.dmp

Filesize
304KB

Download