Analysis

  • max time kernel
    293s
  • max time network
    298s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    16/08/2022, 14:16

General

  • Target

    new orders.js

  • Size

    388KB

  • MD5

    fbbfbf5e808c73443ce1045c58993b58

  • SHA1

    32493b8d3858783d5098db1040f49d796e6475f0

  • SHA256

    41a2892987c1d6a2d2815fe7a06897b873003d65e32ead538e5de8b2b09a904a

  • SHA512

    30851c706dc2b5be2466085d4cef6994a4faaf1fa677d1012c727af6730cec88409131340d8c6fee93fd67fac004c565e51793dad451107ce4dfec3ba22b2c25

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 32 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops startup file 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\new orders.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:760
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\SiytxiPIfa.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      PID:1888
    • C:\Users\Admin\AppData\Local\Temp\G&M.exe
      "C:\Users\Admin\AppData\Local\Temp\G&M.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:1620

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\G&M.exe

          Filesize

          210KB

          MD5

          6c208094e087f84ad4c1790292260317

          SHA1

          786c84e457c75151d7fd53ea7ca654af0d879495

          SHA256

          8c5d8dfc636d3a5461186f7ce756881fe78cb82c305fce1d81b470474e7802f9

          SHA512

          d31bfda484a83aa1a25ce5f86058227af34f6e8ecb84c7092331c560908971c551cff11801439df7a4df133b86fcf402f6aa692ed3cb21e58eba122614635fb4

        • C:\Users\Admin\AppData\Local\Temp\G&M.exe

          Filesize

          210KB

          MD5

          6c208094e087f84ad4c1790292260317

          SHA1

          786c84e457c75151d7fd53ea7ca654af0d879495

          SHA256

          8c5d8dfc636d3a5461186f7ce756881fe78cb82c305fce1d81b470474e7802f9

          SHA512

          d31bfda484a83aa1a25ce5f86058227af34f6e8ecb84c7092331c560908971c551cff11801439df7a4df133b86fcf402f6aa692ed3cb21e58eba122614635fb4

        • C:\Users\Admin\AppData\Roaming\SiytxiPIfa.js

          Filesize

          6KB

          MD5

          a2079e0212dfd821a8ee552397bff943

          SHA1

          3464c8d0d2cfff3275714c0f9f506c81e53c27f2

          SHA256

          cacdff6af2acf1838783fb80822df7a13ef9a4b0865ec067dbca6d7557498d0e

          SHA512

          df99ec27d74cfd7cd513a6960b531bfe0bdb8151e5890bb1b35ce8d815c9560646bbc0efaa8f4f27e531ba932b08fc83d4bdaafcda04ff376e6f5aef9adaf845

        • memory/760-54-0x000007FEFC041000-0x000007FEFC043000-memory.dmp

          Filesize

          8KB

        • memory/1620-61-0x0000000000850000-0x000000000088A000-memory.dmp

          Filesize

          232KB

        • memory/1620-62-0x0000000076141000-0x0000000076143000-memory.dmp

          Filesize

          8KB