a2b7af2875c738b09e0765bf0d8175e9d7af4bfb75e0b5b45d7a56bd6bc70c7b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gst on services provided to foreign company in india 89317.js
Size 1.7MB
Sample240312-k5f2esfb73
SHA256 f47c5cf098750c861b5745b173448a43918b55aa6759b47ccbdcf2a901eda40c
MD5 6b0e448d285f3f1620a8b241e9d171ba
SHA1 52253fb2e1c2cbc441d2c708d5e031f7de9dd16f
SHA512 9ea7e9caf6eb05222d9293d4df7c0bcfe808d482aa0fd939f53e8b76bb0ce96566c12e6eb2f7ba7fa91f95bb7a22c4080651c4153d633b94c5b9f1c2d8e0292c
SSDEEP 12288:Se/9UYbhfw4Y/Oz2z+FIE5AlQlDu90TsDJWx5u1xNydLpg8hC6gQl6GfwgqqQkvK:SeFPbhfj8tWHu1/wD5HroObm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1636	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2472	2816	taskeng.exe	29
PID 2816 wrote to memory of 2472	2816	taskeng.exe	29
PID 2816 wrote to memory of 2472	2816	taskeng.exe	29
PID 2472 wrote to memory of 1340	2472	wscript.EXE	32
PID 2472 wrote to memory of 1340	2472	wscript.EXE	32
PID 2472 wrote to memory of 1340	2472	wscript.EXE	32
PID 1340 wrote to memory of 1636	1340	cscript.exe	34
PID 1340 wrote to memory of 1636	1340	cscript.exe	34
PID 1340 wrote to memory of 1636	1340	cscript.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\gst on services provided to foreign company in india 89317.js"
1⤵
PID:2872

C:\Windows\system32\taskeng.exe
taskeng.exe {73E7A09F-8590-4950-BA70-65B585CBB836} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE MATHEM~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "MATHEM~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MATHEM~1.JS

Path C:\Users\Admin\AppData\Roaming\Media Center Programs\MATHEM~1.JS
Size 16.3MB
SHA256 8cb8d5ef9f35ebb18683244dc502c24757d9bf3f673ebba85ffa152ac250808f
MD5 ec1616c0ea477e2c9bcfccc172064835
SHA1 42d56e7b7b6fa09df4d7217c5953364bbdc9be2d
SHA512 5b6c38bc1defc4901dbc9b0fb2f925cf130b98303707bd7cea1c38ef6ea6dbf812ab413df5d1a8332c33fc843ab66578a8a3c4338eb1e5e253f745f96e99bd42
SSDEEP 49152:cnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn4:t
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1636-8-0x0000000002DE0000-0x0000000002E60000-memory.dmp

Download

memory/1636-7-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

Download

memory/1636-9-0x0000000002DE0000-0x0000000002E60000-memory.dmp

Download

memory/1636-11-0x0000000002DE0000-0x0000000002E60000-memory.dmp

Download

memory/1636-12-0x0000000001E80000-0x0000000001E88000-memory.dmp

Download

memory/1636-10-0x000000001B740000-0x000000001BA22000-memory.dmp

Download

memory/1636-13-0x0000000002DE0000-0x0000000002E60000-memory.dmp

Download

memory/1636-14-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

Download

memory/1636-15-0x0000000002DE0000-0x0000000002E60000-memory.dmp

Download

memory/1636-16-0x0000000002DE0000-0x0000000002E60000-memory.dmp

Download

memory/1636-17-0x0000000002DE0000-0x0000000002E60000-memory.dmp

Download