Analysis
- max time kernel
125s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
01/08/2023, 00:51
General
- Target Bank Verfification Form - Account Confirmatio.js
- Size 362KB
- Sample230801-a7g2dscb88
- SHA256 3841d50e1acd5bb1af45f52b341e3b01fdb55f9881e587904719e9dec701855c
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Bank Verfification Form - Account Confirmatio.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\xqycgyo.txt"2⤵
- Drops file in Program Files directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
xqycgyo.txt
memory/2524-137-0x0000000003010000-0x0000000004010000-memory.dmp
memory/2524-146-0x0000000002DD0000-0x0000000002DD1000-memory.dmp
memory/2524-153-0x0000000003010000-0x0000000004010000-memory.dmp
memory/2524-155-0x0000000003290000-0x00000000032A0000-memory.dmp
memory/2524-156-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/2524-157-0x0000000003010000-0x0000000004010000-memory.dmp