Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
23-06-2022 05:56
Static task
static1
Behavioral task
behavioral1
Sample
Machinery Specification And Models.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Machinery Specification And Models.js
Resource
win10v2004-20220414-en
General
-
Target
Machinery Specification And Models.js
-
Size
934KB
-
MD5
f0c5b13e7ce8bb82395f166cb95f1b70
-
SHA1
c5e269f5d14782699aec933cdc2c76c920e09816
-
SHA256
74a834ad404d9fc6fbbd0e1afc46df019cd7d4f8d5e60353d08172765e06177f
-
SHA512
5c0810178ae840a48f8c74e487061f7215c37d50a077b4cbf9724a17750057c9e921e553170f245d904cd416c7efcca1d4a02998d6ee484365580d6524b5c2c3
Malware Config
Extracted
Protocol: smtp- Host:
mail.leaf.arvixe.com - Port:
587 - Username:
[email protected] - Password:
000000
Extracted
agenttesla
Protocol: smtp- Host:
mail.leaf.arvixe.com - Port:
587 - Username:
[email protected] - Password:
000000
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE AgentTesla Exfil Via SMTP
suricata: ET MALWARE AgentTesla Exfil Via SMTP
-
Blocklisted process makes network request 33 IoCs
Processes:
wscript.exewscript.exewscript.exeflow pid process 6 1944 wscript.exe 7 4720 wscript.exe 8 1988 wscript.exe 18 4720 wscript.exe 19 1944 wscript.exe 25 4720 wscript.exe 26 1944 wscript.exe 34 1944 wscript.exe 36 4720 wscript.exe 38 1944 wscript.exe 39 4720 wscript.exe 41 1944 wscript.exe 42 4720 wscript.exe 48 1944 wscript.exe 49 4720 wscript.exe 52 1944 wscript.exe 53 4720 wscript.exe 54 1944 wscript.exe 55 4720 wscript.exe 57 1944 wscript.exe 58 4720 wscript.exe 60 1944 wscript.exe 61 4720 wscript.exe 62 1944 wscript.exe 63 4720 wscript.exe 65 1944 wscript.exe 66 4720 wscript.exe 67 1944 wscript.exe 68 4720 wscript.exe 70 1944 wscript.exe 71 4720 wscript.exe 72 1944 wscript.exe 73 4720 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
ORIPAYLOADER.exepid process 4732 ORIPAYLOADER.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exewscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 5 IoCs
Processes:
wscript.exewscript.exewscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Machinery Specification And Models.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Machinery Specification And Models.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cKBGNvUvAk.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cKBGNvUvAk.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cKBGNvUvAk.js wscript.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
ORIPAYLOADER.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ORIPAYLOADER.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ORIPAYLOADER.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ORIPAYLOADER.exe -
Adds Run key to start application 2 TTPs 12 IoCs
Processes:
wscript.exewscript.exewscript.exewscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\cKBGNvUvAk.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\cKBGNvUvAk.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Machinery Specification And Models = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Machinery Specification And Models.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Machinery Specification And Models = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Machinery Specification And Models.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Machinery Specification And Models = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Machinery Specification And Models.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\software\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Machinery Specification And Models = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Machinery Specification And Models.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ORIPAYLOADER.exepid process 4732 ORIPAYLOADER.exe 4732 ORIPAYLOADER.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ORIPAYLOADER.exedescription pid process Token: SeDebugPrivilege 4732 ORIPAYLOADER.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ORIPAYLOADER.exepid process 4732 ORIPAYLOADER.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
wscript.exewscript.exedescription pid process target process PID 1088 wrote to memory of 1944 1088 wscript.exe wscript.exe PID 1088 wrote to memory of 1944 1088 wscript.exe wscript.exe PID 1088 wrote to memory of 1988 1088 wscript.exe wscript.exe PID 1088 wrote to memory of 1988 1088 wscript.exe wscript.exe PID 1988 wrote to memory of 4720 1988 wscript.exe wscript.exe PID 1988 wrote to memory of 4720 1988 wscript.exe wscript.exe PID 1988 wrote to memory of 4732 1988 wscript.exe ORIPAYLOADER.exe PID 1988 wrote to memory of 4732 1988 wscript.exe ORIPAYLOADER.exe PID 1988 wrote to memory of 4732 1988 wscript.exe ORIPAYLOADER.exe -
outlook_office_path 1 IoCs
Processes:
ORIPAYLOADER.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ORIPAYLOADER.exe -
outlook_win_path 1 IoCs
Processes:
ORIPAYLOADER.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ORIPAYLOADER.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Machinery Specification And Models.js"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\cKBGNvUvAk.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Machinery Specification And Models.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\cKBGNvUvAk.js"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\ORIPAYLOADER.exe"C:\Users\Admin\AppData\Roaming\ORIPAYLOADER.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Machinery Specification And Models.jsFilesize
934KB
MD5f0c5b13e7ce8bb82395f166cb95f1b70
SHA1c5e269f5d14782699aec933cdc2c76c920e09816
SHA25674a834ad404d9fc6fbbd0e1afc46df019cd7d4f8d5e60353d08172765e06177f
SHA5125c0810178ae840a48f8c74e487061f7215c37d50a077b4cbf9724a17750057c9e921e553170f245d904cd416c7efcca1d4a02998d6ee484365580d6524b5c2c3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Machinery Specification And Models.jsFilesize
934KB
MD5f0c5b13e7ce8bb82395f166cb95f1b70
SHA1c5e269f5d14782699aec933cdc2c76c920e09816
SHA25674a834ad404d9fc6fbbd0e1afc46df019cd7d4f8d5e60353d08172765e06177f
SHA5125c0810178ae840a48f8c74e487061f7215c37d50a077b4cbf9724a17750057c9e921e553170f245d904cd416c7efcca1d4a02998d6ee484365580d6524b5c2c3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cKBGNvUvAk.jsFilesize
117KB
MD55ec7e975e42079dacb58ad5e712df35f
SHA16c963b465c7ddc9081add19f0c99eac3e969f819
SHA2564be6ef286e027bd596340d08cc8640d213cff7fbf93638a2ccee267fa42512b8
SHA512ca38464e394d43a8320baa24163cf3921a66ce3a87a8f4da7d20718ab6248319cb6d08de61509b81061d353da23033412fa9b121c14c2c32df5aa2859a7e13a8
-
C:\Users\Admin\AppData\Roaming\ORIPAYLOADER.exeFilesize
209KB
MD5c6d715ba404ae78085eb7caba3ad8118
SHA1720e3ef336871278f87f6eb596147edc4f1e3c4b
SHA2560f33ab5276f7ea785bb119795431a7be45e2ada3428ea1718d799cb654c2bdb2
SHA51261612720aa252713ecdc86e665eaee223f747e602626bf140dceb34ae7e7c18d75cf123de881b36b56c190014513a40375bc8e5267d1c120cc6e8eb8039364e7
-
C:\Users\Admin\AppData\Roaming\ORIPAYLOADER.exeFilesize
209KB
MD5c6d715ba404ae78085eb7caba3ad8118
SHA1720e3ef336871278f87f6eb596147edc4f1e3c4b
SHA2560f33ab5276f7ea785bb119795431a7be45e2ada3428ea1718d799cb654c2bdb2
SHA51261612720aa252713ecdc86e665eaee223f747e602626bf140dceb34ae7e7c18d75cf123de881b36b56c190014513a40375bc8e5267d1c120cc6e8eb8039364e7
-
C:\Users\Admin\AppData\Roaming\cKBGNvUvAk.jsFilesize
117KB
MD55ec7e975e42079dacb58ad5e712df35f
SHA16c963b465c7ddc9081add19f0c99eac3e969f819
SHA2564be6ef286e027bd596340d08cc8640d213cff7fbf93638a2ccee267fa42512b8
SHA512ca38464e394d43a8320baa24163cf3921a66ce3a87a8f4da7d20718ab6248319cb6d08de61509b81061d353da23033412fa9b121c14c2c32df5aa2859a7e13a8
-
C:\Users\Admin\AppData\Roaming\cKBGNvUvAk.jsFilesize
117KB
MD55ec7e975e42079dacb58ad5e712df35f
SHA16c963b465c7ddc9081add19f0c99eac3e969f819
SHA2564be6ef286e027bd596340d08cc8640d213cff7fbf93638a2ccee267fa42512b8
SHA512ca38464e394d43a8320baa24163cf3921a66ce3a87a8f4da7d20718ab6248319cb6d08de61509b81061d353da23033412fa9b121c14c2c32df5aa2859a7e13a8
-
memory/1944-130-0x0000000000000000-mapping.dmp
-
memory/1988-132-0x0000000000000000-mapping.dmp
-
memory/4720-134-0x0000000000000000-mapping.dmp
-
memory/4732-137-0x0000000000000000-mapping.dmp
-
memory/4732-141-0x0000000000560000-0x000000000059A000-memory.dmpFilesize
232KB
-
memory/4732-142-0x0000000005510000-0x0000000005AB4000-memory.dmpFilesize
5.6MB
-
memory/4732-143-0x0000000005000000-0x000000000509C000-memory.dmpFilesize
624KB
-
memory/4732-144-0x0000000005C00000-0x0000000005C66000-memory.dmpFilesize
408KB
-
memory/4732-145-0x00000000061F0000-0x0000000006240000-memory.dmpFilesize
320KB
-
memory/4732-146-0x0000000006550000-0x00000000065E2000-memory.dmpFilesize
584KB
-
memory/4732-147-0x00000000061E0000-0x00000000061EA000-memory.dmpFilesize
40KB