d450d3fcd798f64c834ca00597bf4ce525e84f5ba4c7f40ba587cb449f2df75e

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Imagem_Comprovante.exe
Size

68KB
MD5

ea52d9f69f36b74c05e2aa747bbbf3ae
SHA1

01617671dc734497254d28d500946cc71795e8f5
SHA256

3a45e3edb03123ed37cea8a9263e3e579eb945b9c400a6c37eec5749a02e3fa6
SHA512

c5f1b1639ed90e5040315907c90ef6853c2527002e063378032c6b24009966d7a0dcb7740fb0a9ed51f768558e19c323de22a3d63ff61717e6e2a70ef3ba41b6
SSDEEP

1536:dw4fpS/nSciztM74N0DIDidcBdWmcpxtB7O4nMQ073QAj:dw4gnScGuDI2dcBdWZBa4JO3b

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3872	Imagem_Comprovante.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imagem_Comprovante.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4264	3872	Imagem_Comprovante.exe	94
PID 3872 wrote to memory of 4264	3872	Imagem_Comprovante.exe	94
PID 3872 wrote to memory of 4264	3872	Imagem_Comprovante.exe	94

C:\Users\Admin\AppData\Local\Temp\Imagem_Comprovante.exe
"C:\Users\Admin\AppData\Local\Temp\Imagem_Comprovante.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\ProgramData\jane83.js"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\jane83.js

Filesize
14KB

MD5
7ddae2a962f3d9eec131b8e828b5e1b6

SHA1
e8d71fa55902c2bc067f72a2ada0c58c7c6d98ee

SHA256
097293442f2024e47561b0ba1e649c6834c81465b12aa7577afaf9800addd083

SHA512
c8fa0497467e1ce3e82c44441434851c012bf062c01e00f6c16d518b5d916a28c035bc4a872056f55a3e7cfa07248edfe455ed5953c2c78883de4abaf357eb5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7EF5.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit