183cf9debbcdd31b02ac5b07da2c5750fc7ce3ab420bed68fc9921a5f5a75b01

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

osha mezzanine load posting requirements 99080.js
Size

18.5MB
MD5

56a46effe9096b9b2b35516e4eaedfde
SHA1

b3974a58150c9cf513d47cb0230930a997b179b7
SHA256

183cf9debbcdd31b02ac5b07da2c5750fc7ce3ab420bed68fc9921a5f5a75b01
SHA512

5db572a3b17d4198f5807d05a8157891778a07726a28d20840d369a5586e0f21c6058c736d8cd26b1cc3a483eb067303cfa18084b04255aa0b9f0e19945b6b70
SSDEEP

49152:CHI08dPXWR4ba/JOtdF5pHE2lsfiaahM3o43ORV59VDKtDvHI08dPXWR4ba/JOtH:Ac43m6c43m6c43m6c43ml

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
2836	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	2836	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

taskeng.exewscript.EXEcscript.exe

description	pid	Process	procid_target
PID 2696 wrote to memory of 2736	2696	taskeng.exe	31
PID 2696 wrote to memory of 2736	2696	taskeng.exe	31
PID 2696 wrote to memory of 2736	2696	taskeng.exe	31
PID 2736 wrote to memory of 2852	2736	wscript.EXE	32
PID 2736 wrote to memory of 2852	2736	wscript.EXE	32
PID 2736 wrote to memory of 2852	2736	wscript.EXE	32
PID 2852 wrote to memory of 2836	2852	cscript.exe	34
PID 2852 wrote to memory of 2836	2852	cscript.exe	34
PID 2852 wrote to memory of 2836	2852	cscript.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\osha mezzanine load posting requirements 99080.js"
1⤵
PID:2172

C:\Windows\system32\taskeng.exe
taskeng.exe {0A528F55-BD09-410B-9BB7-6CA296F3F488} S-1-5-21-2257386474-3982792636-3902186748-1000:CTBHAMHL\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE PROPEL~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "PROPEL~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Media Center Programs\PROPEL~1.JS

Filesize
44.6MB

MD5
6827398e04fd4935de3a38709838147f

SHA1
1b35b05b9fac4b2461f5a629ba9c15a276d8f6f2

SHA256
8bcc633e5378af9cf4fd35485be4ab4a3630606ea1a0e67185f5810b483abdcf

SHA512
22a132d9babcfbd23f0ab4ebb0c5a2e799358fd554d5326a2ee8d2d36b73d7f43447057b41710fc7a51422532809b3ddca4fda5949780ad42142fa7d9b9a2a9a

Download Submit
memory/2836-7-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2836-8-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download