9b66a8ea0f1c64965b06e7a45afbe56f2d4e6d5ef65f32446defccbebe730813

General

Target

calc.exe
Size

201KB
MD5

2f9fdad776d8626f2ce8625211831e91
SHA1

21d8413eb0d60b36fc249f8025c277b557fefde3
SHA256

9b66a8ea0f1c64965b06e7a45afbe56f2d4e6d5ef65f32446defccbebe730813
SHA512

2abd61c6bea7c748f81cdd18133582217bd06dd19506f13f89953f8c7bd662fc5233540b9f56c57aa94e038c674128fc46dd280e2f7db642343fc5a45da25feb
SSDEEP

6144:96LkVO8A1X2og0tEHH45Y0KTIVaTycTVDNe4oI:TMJ1X2og0MHGKT3RRwG

Score

9^/10

discovery execution upx

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	calc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	wscript.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2624-0-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral2/memory/2624-5-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral2/memory/4704-7-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral2/memory/4704-8-0x0000000000400000-0x000000000048B000-memory.dmp	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Runs net.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1164	2624	calc.exe	82
PID 2624 wrote to memory of 1164	2624	calc.exe	82
PID 2624 wrote to memory of 1164	2624	calc.exe	82
PID 1164 wrote to memory of 1820	1164	wscript.exe	83
PID 1164 wrote to memory of 1820	1164	wscript.exe	83
PID 1164 wrote to memory of 1820	1164	wscript.exe	83
PID 1164 wrote to memory of 4824	1164	wscript.exe	85
PID 1164 wrote to memory of 4824	1164	wscript.exe	85
PID 1164 wrote to memory of 4824	1164	wscript.exe	85
PID 1164 wrote to memory of 4704	1164	wscript.exe	87
PID 1164 wrote to memory of 4704	1164	wscript.exe	87
PID 1164 wrote to memory of 4704	1164	wscript.exe	87
PID 1820 wrote to memory of 3136	1820	net.exe	88
PID 1820 wrote to memory of 3136	1820	net.exe	88
PID 1820 wrote to memory of 3136	1820	net.exe	88
PID 4824 wrote to memory of 4240	4824	net.exe	89
PID 4824 wrote to memory of 4240	4824	net.exe	89
PID 4824 wrote to memory of 4240	4824	net.exe	89

C:\Users\Admin\AppData\Local\Temp\calc.exe
"C:\Users\Admin\AppData\Local\Temp\calc.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" IKmudel0sm.jse
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" user LocalAdministrator /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user LocalAdministrator /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:4240
- - C:\Users\Admin\AppData\Local\Temp\calc.exe
    "C:\Users\Admin\AppData\Local\Temp\calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Account Manipulation

1

T1098

Privilege Escalation

Account Manipulation

1

T1098

Defense Evasion

Credential Access

Discovery

Permission Groups Discovery

1

T1069

Local Groups

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IKmudel0sm.jse

Filesize
905B

MD5
b4eb7f28555dda63f591a950f2db89d1

SHA1
92ba2174422096a09ce506c041165564360accc3

SHA256
00c9f54dc4deec12db8ba086ec347d03f978e46222d9c5ec5c6240f7ac171c5c

SHA512
3268de3032832a54e3251589b6d41ff43f3181e7fbc5de6d466ea45c6db0c8bba6704f87954b4e28a9273067ebe20066169ff70f896a236a3f786291fb660d24

Download Submit
memory/2624-0-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2624-5-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4704-7-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4704-8-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download

Analysis

Sharing