9b66a8ea0f1c64965b06e7a45afbe56f2d4e6d5ef65f32446defccbebe730813

General

Target

calc.exe
Size

201KB
MD5

2f9fdad776d8626f2ce8625211831e91
SHA1

21d8413eb0d60b36fc249f8025c277b557fefde3
SHA256

9b66a8ea0f1c64965b06e7a45afbe56f2d4e6d5ef65f32446defccbebe730813
SHA512

2abd61c6bea7c748f81cdd18133582217bd06dd19506f13f89953f8c7bd662fc5233540b9f56c57aa94e038c674128fc46dd280e2f7db642343fc5a45da25feb
SSDEEP

6144:96LkVO8A1X2og0tEHH45Y0KTIVaTycTVDNe4oI:TMJ1X2og0MHGKT3RRwG

Score

9^/10

discovery execution upx

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2688-8-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/2840-7-0x0000000003860000-0x00000000038EB000-memory.dmp	upx
behavioral1/memory/2160-5-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/2160-0-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/2688-9-0x0000000000400000-0x000000000048B000-memory.dmp	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2688	calc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2840	2160	calc.exe	30
PID 2160 wrote to memory of 2840	2160	calc.exe	30
PID 2160 wrote to memory of 2840	2160	calc.exe	30
PID 2160 wrote to memory of 2840	2160	calc.exe	30
PID 2840 wrote to memory of 2612	2840	wscript.exe	31
PID 2840 wrote to memory of 2612	2840	wscript.exe	31
PID 2840 wrote to memory of 2612	2840	wscript.exe	31
PID 2840 wrote to memory of 2612	2840	wscript.exe	31
PID 2840 wrote to memory of 2604	2840	wscript.exe	33
PID 2840 wrote to memory of 2604	2840	wscript.exe	33
PID 2840 wrote to memory of 2604	2840	wscript.exe	33
PID 2840 wrote to memory of 2604	2840	wscript.exe	33
PID 2604 wrote to memory of 2740	2604	net.exe	35
PID 2604 wrote to memory of 2740	2604	net.exe	35
PID 2604 wrote to memory of 2740	2604	net.exe	35
PID 2604 wrote to memory of 2740	2604	net.exe	35
PID 2612 wrote to memory of 2748	2612	net.exe	36
PID 2612 wrote to memory of 2748	2612	net.exe	36
PID 2612 wrote to memory of 2748	2612	net.exe	36
PID 2612 wrote to memory of 2748	2612	net.exe	36
PID 2840 wrote to memory of 2688	2840	wscript.exe	37
PID 2840 wrote to memory of 2688	2840	wscript.exe	37
PID 2840 wrote to memory of 2688	2840	wscript.exe	37
PID 2840 wrote to memory of 2688	2840	wscript.exe	37

C:\Users\Admin\AppData\Local\Temp\calc.exe
"C:\Users\Admin\AppData\Local\Temp\calc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" 3MknSo1yGp.jse
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" user LocalAdministrator /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user LocalAdministrator /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2740
- - C:\Users\Admin\AppData\Local\Temp\calc.exe
    "C:\Users\Admin\AppData\Local\Temp\calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Account Manipulation

1

T1098

Privilege Escalation

Account Manipulation

1

T1098

Defense Evasion

Credential Access

Discovery

Permission Groups Discovery

1

T1069

Local Groups

1

T1069.001

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3MknSo1yGp.jse

Filesize
905B

MD5
b4eb7f28555dda63f591a950f2db89d1

SHA1
92ba2174422096a09ce506c041165564360accc3

SHA256
00c9f54dc4deec12db8ba086ec347d03f978e46222d9c5ec5c6240f7ac171c5c

SHA512
3268de3032832a54e3251589b6d41ff43f3181e7fbc5de6d466ea45c6db0c8bba6704f87954b4e28a9273067ebe20066169ff70f896a236a3f786291fb660d24

Download Submit
memory/2160-5-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2160-0-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2688-8-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2688-9-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2840-7-0x0000000003860000-0x00000000038EB000-memory.dmp

Filesize
556KB

Download

Analysis

Sharing