2c84d62d067a3abd72485d759dff184aee864fa6b6015c557834f331766be14b

Resubmissions

05/04/2024, 22:51

240405-2s5mpaed8w10

05/04/2024, 22:09

240405-12qz8aee4910

05/04/2024, 21:44

240405-1lp3zseb9410

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
california law on heating in rented property 57920.js
Size 28.9MB
Sample240405-2s5mpaed8w
SHA256 faa386a653305f00e34bcd94511480b809b221ebf7205319578ef4ec9c050605
MD5 6549d39c02c70808198741b87b6aec8d
SHA1 8a2d9af6453338427b63cd9f7e3020f37ac1aa73
SHA512 8d6f83edec2082e99aa02fb47964828c2d6b0a2e26016720dbbd64430e45c37499a3224c7fdb7f14c679dfc0a68431e0460e4600c969fbdb523a099ef188f839
SSDEEP 49152:v7BZzjCxbgqHlpRwVON0kLhG5JizUYzYBGZP+8Hzm3nI/NlHGy/R3qy/a7gbcEOI:2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
548	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1664	2420	taskeng.exe	31
PID 2420 wrote to memory of 1664	2420	taskeng.exe	31
PID 2420 wrote to memory of 1664	2420	taskeng.exe	31
PID 1664 wrote to memory of 276	1664	wscript.EXE	32
PID 1664 wrote to memory of 276	1664	wscript.EXE	32
PID 1664 wrote to memory of 276	1664	wscript.EXE	32
PID 276 wrote to memory of 548	276	cscript.exe	34
PID 276 wrote to memory of 548	276	cscript.exe	34
PID 276 wrote to memory of 548	276	cscript.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\california law on heating in rented property 57920.js"
1⤵
PID:2848

C:\Windows\system32\taskeng.exe
taskeng.exe {CB310CC6-44A2-400A-95EE-6F07C1ADB2B5} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE GLOBAL~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "GLOBAL~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GLOBAL~1.JS

Path C:\Users\Admin\AppData\Roaming\Media Center Programs\GLOBAL~1.JS
Size 39.2MB
SHA256 d088fcbe34d8438e9b881c0847c5991cb19be058f3208c14637fce214e13b3d8
MD5 5085842509fd3af705786223524a74a3
SHA1 40e92fe49e00652692f6067e22f2d4fe43a1cb5f
SHA512 6644a446d108735e41def63f2f76a8feba3e8d18144f55b0aaa39a17046428ce40dc04e045ffad3c2d6ea4614c3d9aae933d9df9f67889b2217cc6f5445a50f4
SSDEEP 12288:EKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKW:L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/548-9-0x0000000002910000-0x0000000002990000-memory.dmp

Download

memory/548-8-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Download

memory/548-7-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Download

memory/548-10-0x0000000001E00000-0x0000000001E08000-memory.dmp

Download

memory/548-12-0x0000000002910000-0x0000000002990000-memory.dmp

Download

memory/548-11-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Download

memory/548-13-0x0000000002910000-0x0000000002990000-memory.dmp

Download

memory/548-14-0x0000000002910000-0x0000000002990000-memory.dmp

Download

memory/548-15-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Download

memory/548-16-0x0000000002910000-0x0000000002990000-memory.dmp

Download

memory/548-17-0x0000000002910000-0x0000000002990000-memory.dmp

Download

memory/548-18-0x0000000002910000-0x0000000002990000-memory.dmp

Download