5f4b5467cccbbc2f2c5771d9547e7fca350df341d154f4d83a4442b7a44cdf06

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gcahfpmhcn.js
Size 1006KB
Sample240416-whe2dsab7y
SHA256 5f4b5467cccbbc2f2c5771d9547e7fca350df341d154f4d83a4442b7a44cdf06
MD5 5bca887380e1881f351c22574d257e41
SHA1 987634d53966aa6e84c72ad366bb78e619cb674a
SHA512 26c9da1464668a4d084095c4425f3e51c9c875e57315b8356081ab2ef032e5bfb28cbbef99d915dc626267c3abc9f8c134cae6778b5679e828fd55558946b92d
SSDEEP 12288:k5hvpTSH6kI3/VITSZjbZkgdciA5Y0y9BY7BA0Et5YdtFpGzN3w1xYZWkTSP4Wn:kXpWH9eZZjdkeCjmlY3FeNgwuP4G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	wscript.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2160	icacls.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 4532	932	wscript.exe	84
PID 932 wrote to memory of 4532	932	wscript.exe	84
PID 4532 wrote to memory of 2160	4532	javaw.exe	85
PID 4532 wrote to memory of 2160	4532	javaw.exe	85
PID 4532 wrote to memory of 4164	4532	javaw.exe	88
PID 4532 wrote to memory of 4164	4532	javaw.exe	88

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\gcahfpmhcn.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:932
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ysklsb.txt"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:2160
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.38410895779467295817942809744210711.class
    3⤵
    - Drops file in Program Files directory
    PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 b6a68528fcc786f108e959286fdcc0f3c045ef79ebb63f5659dfb4d733b4a10c
MD5 9d1e70100cfad8d365c3f07d14a3aca7
SHA1 2c5724e31080cdc80f9dfa6c01789e097d9e9e1b
SHA512 a7bcbd81f4339761de8d136dceea4c0b08054db07166a81d827ea7ace0292fbbd8b778ce3a98909b2cc7287fbb7984fbaab1c221bea524c1ec8a82b62a46f8ce
MD5 SHA1 SHA512

Submit Download

_0.38410895779467295817942809744210711.class

Path C:\Users\Admin\AppData\Local\Temp\_0.38410895779467295817942809744210711.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_7c31d3ed-7f70-49de-870c-1f0d986cd62d

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2288054676-1871194608-3559553667-1000\83aa4cc77f591dfc2374580bbd95f6ba_7c31d3ed-7f70-49de-870c-1f0d986cd62d
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

ysklsb.txt

Path C:\Users\Admin\AppData\Roaming\ysklsb.txt
Size 479KB
SHA256 4c81c42509988b29c4d77288ed55849de919676fbca4a938bf773f893f2e547e
MD5 d7d1131452a0427e78a2710d280537b5
SHA1 279b601cb79c5d1790910c839125a45b2f43101d
SHA512 483d03f5dcf0011679463a68f233cb50796c056d1045cc6eeaccae41ffbe51e562a186f6cd6196b0c3b63631553a7d780d6d77648117903e4d58238b2ef8d198
SSDEEP 12288:x8h4GbbFN8rQO/rATlnt85pxogQNUhIK/0c2qnAU:x83T88O/NsS7B2qnl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4164-24-0x0000020280000000-0x0000020281000000-memory.dmp

Download

memory/4164-32-0x00000202FB780000-0x00000202FB781000-memory.dmp

Download

memory/4164-41-0x0000020280000000-0x0000020281000000-memory.dmp

Download

memory/4164-43-0x0000020280280000-0x0000020280290000-memory.dmp

Download

memory/4164-44-0x0000020280290000-0x00000202802A0000-memory.dmp

Download

memory/4164-45-0x0000020280000000-0x0000020281000000-memory.dmp

Download

memory/4532-6-0x00000183DE720000-0x00000183DF720000-memory.dmp

Download

memory/4532-22-0x00000183DCCE0000-0x00000183DCCE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads