6e7d9dd5f3eb0f8af293daeb005c28d7c6a7d20c6aab2d2de616eb8f59f2d7a5

General

Target
Contractvoorwaarden-pdf.js
Size 341KB
Sample260109-v1ctbab14a
SHA256 6e7d9dd5f3eb0f8af293daeb005c28d7c6a7d20c6aab2d2de616eb8f59f2d7a5
MD5 bc8d1ff86e28f40bb38e92c27683bd2f
SHA1 7ea884f5bccd37c27148deb7d04dde97c524df8b
SHA512 9abf72724a674cc77ac6561c27863886769871e55e675577545c0dadfe4e53a119c29e1737fd303a6ebfe1b4b0ee0a4f0b1e67ee42e197aa0780034fd3822ac2
SSDEEP 6144:DIxwL96KYv3KzQ1jb760OPGuVhMT3RoSg0zLqrdOQjMCx5svwt62ZA1hnBCh:Dmv3KzQ1Xe07yhARoSnz2rdDjhSvsf62
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware execution spyware

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5804	wscript.exe
3	3984	powershell.exe
4	3984	powershell.exe
5	3984	powershell.exe
6	3984	powershell.exe
8	3984	powershell.exe
9	3984	powershell.exe
10	3984	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\Registry\User\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1620883563-4153065746-604429412-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5864	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3984	powershell.exe
3984	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5864	explorer.exe
5864	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 5092	5804	wscript.exe	77
PID 5864 wrote to memory of 3984	5864	explorer.exe	79

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Contractvoorwaarden-pdf.js
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" c:\windows\Helflask.lnk
  2⤵
  PID:5092

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Gran=($env:APPDATA+'\Reerupti');$Samme=gc $Gran;$unscrutin=$Samme[5005..5007] -join $Leasin; .($unscrutin) $Samme"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_pijpbfwq.dp0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pijpbfwq.dp0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Reerupti

Path C:\Users\Admin\AppData\Roaming\Reerupti
Size 4KB
SHA256 4c32b356797baccfd795107e7526cdb6dd69d491d8363f061db14052476a19c3
MD5 fb5004f8085adacd71bbeff75bd595b0
SHA1 a5b349e80c3ffa96f9f20c353301c2c0abcc2d5c
SHA512 6c30031ced5a22e0371b9b7298db7c6045940860542385e71a911fc195478505327ef9c4db5511d03b77b330af06a49fab5cbdfef080b05fa772a3ad4cbf0219
SSDEEP 96:NJ61DiFG2C3VYiT11c+gO4VffGF3r2zAJhRkoTr4KRpSH:CDR3VjlgOyfk3rzPRkoX4qpSH
TLSH
T16DA14C02A6D143520D2C08B6CD9302605D33DA4A1B72D765E358B5DF37CD6E7936C71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3984-7-0x000001D0C0D70000-0x000001D0C0D92000-memory.dmp

Download

Analysis

Sharing