Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
26/09/2024, 10:21
General
- Target PO#518463.js
- Size 453KB
- Sample240926-mdm2rsvfna
- SHA256 5709dc35796f2a91483860820770e74dead9f01eaf2433832016fdacd2eed209
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PO#518463.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\jhnkxdbyn.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\jhnkxdbyn.txt"3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\jhnkxdbyn.txt"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\jhnkxdbyn.txt"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\jhnkxdbyn.txt"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
3903daac9bc4a3b7.timestamp
jna5582383184651871575.dll
83aa4cc77f591dfc2374580bbd95f6ba_6f95b8b4-c02b-43c9-8cd4-016780936b63
jhnkxdbyn.txt
jna-5.5.0.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1896-99-0x000001DCBDC40000-0x000001DCBDC41000-memory.dmp
memory/1896-77-0x000001DCBF8B0000-0x000001DCBF8C0000-memory.dmp
memory/1896-114-0x000001DCBF960000-0x000001DCBF970000-memory.dmp
memory/1896-26-0x000001DCBF7C0000-0x000001DCBF7D0000-memory.dmp
memory/1896-28-0x000001DCBF7E0000-0x000001DCBF7F0000-memory.dmp
memory/1896-27-0x000001DCBF7D0000-0x000001DCBF7E0000-memory.dmp
memory/1896-34-0x000001DCBF7F0000-0x000001DCBF800000-memory.dmp
memory/1896-37-0x000001DCBDC40000-0x000001DCBDC41000-memory.dmp
memory/1896-39-0x000001DCBF500000-0x000001DCBF770000-memory.dmp
memory/1896-44-0x000001DCBF770000-0x000001DCBF780000-memory.dmp
memory/1896-43-0x000001DCBF810000-0x000001DCBF820000-memory.dmp
memory/1896-42-0x000001DCBF820000-0x000001DCBF830000-memory.dmp
memory/1896-41-0x000001DCBF800000-0x000001DCBF810000-memory.dmp
memory/1896-49-0x000001DCBF790000-0x000001DCBF7A0000-memory.dmp
memory/1896-48-0x000001DCBF840000-0x000001DCBF850000-memory.dmp
memory/1896-47-0x000001DCBF830000-0x000001DCBF840000-memory.dmp
memory/1896-46-0x000001DCBF780000-0x000001DCBF790000-memory.dmp
memory/1896-53-0x000001DCBF7B0000-0x000001DCBF7C0000-memory.dmp
memory/1896-55-0x000001DCBF860000-0x000001DCBF870000-memory.dmp
memory/1896-58-0x000001DCBF7C0000-0x000001DCBF7D0000-memory.dmp
memory/1896-59-0x000001DCBF870000-0x000001DCBF880000-memory.dmp
memory/1896-54-0x000001DCBF850000-0x000001DCBF860000-memory.dmp
memory/1896-52-0x000001DCBF7A0000-0x000001DCBF7B0000-memory.dmp
memory/1896-63-0x000001DCBF880000-0x000001DCBF890000-memory.dmp
memory/1896-62-0x000001DCBF7E0000-0x000001DCBF7F0000-memory.dmp
memory/1896-61-0x000001DCBF7D0000-0x000001DCBF7E0000-memory.dmp
memory/1896-66-0x000001DCBF890000-0x000001DCBF8A0000-memory.dmp
memory/1896-67-0x000001DCBDC40000-0x000001DCBDC41000-memory.dmp
memory/1896-70-0x000001DCBF7F0000-0x000001DCBF800000-memory.dmp
memory/1896-71-0x000001DCBF8A0000-0x000001DCBF8B0000-memory.dmp
memory/1896-110-0x000001DCBF950000-0x000001DCBF960000-memory.dmp
memory/1896-76-0x000001DCBF820000-0x000001DCBF830000-memory.dmp
memory/1896-75-0x000001DCBF800000-0x000001DCBF810000-memory.dmp
memory/1896-79-0x000001DCBF8C0000-0x000001DCBF8D0000-memory.dmp
memory/1896-78-0x000001DCBF810000-0x000001DCBF820000-memory.dmp
memory/1896-84-0x000001DCBF8D0000-0x000001DCBF8E0000-memory.dmp
memory/1896-90-0x000001DCBF860000-0x000001DCBF870000-memory.dmp
memory/1896-89-0x000001DCBF850000-0x000001DCBF860000-memory.dmp
memory/1896-88-0x000001DCBF8F0000-0x000001DCBF900000-memory.dmp
memory/1896-87-0x000001DCBF8E0000-0x000001DCBF8F0000-memory.dmp
memory/1896-83-0x000001DCBF840000-0x000001DCBF850000-memory.dmp
memory/1896-82-0x000001DCBF830000-0x000001DCBF840000-memory.dmp
memory/1896-109-0x000001DCBF8B0000-0x000001DCBF8C0000-memory.dmp
memory/1896-96-0x000001DCBF870000-0x000001DCBF880000-memory.dmp
memory/1896-97-0x000001DCBF910000-0x000001DCBF920000-memory.dmp
memory/1896-101-0x000001DCBF920000-0x000001DCBF930000-memory.dmp
memory/1896-100-0x000001DCBF880000-0x000001DCBF890000-memory.dmp
memory/1896-18-0x000001DCBF790000-0x000001DCBF7A0000-memory.dmp
memory/1896-104-0x000001DCBF930000-0x000001DCBF940000-memory.dmp
memory/1896-103-0x000001DCBF890000-0x000001DCBF8A0000-memory.dmp
memory/1896-106-0x000001DCBF8A0000-0x000001DCBF8B0000-memory.dmp
memory/1896-107-0x000001DCBF940000-0x000001DCBF950000-memory.dmp
memory/1896-91-0x000001DCBF900000-0x000001DCBF910000-memory.dmp
memory/1896-22-0x000001DCBF7B0000-0x000001DCBF7C0000-memory.dmp
memory/1896-21-0x000001DCBF7A0000-0x000001DCBF7B0000-memory.dmp
memory/1896-113-0x000001DCBF8C0000-0x000001DCBF8D0000-memory.dmp
memory/1896-115-0x000001DCBF8D0000-0x000001DCBF8E0000-memory.dmp
memory/1896-116-0x000001DCBF970000-0x000001DCBF980000-memory.dmp
memory/1896-118-0x000001DCBF8E0000-0x000001DCBF8F0000-memory.dmp
memory/1896-119-0x000001DCBF8F0000-0x000001DCBF900000-memory.dmp
memory/1896-120-0x000001DCBF980000-0x000001DCBF990000-memory.dmp
memory/1896-122-0x000001DCBDC40000-0x000001DCBDC41000-memory.dmp
memory/1896-128-0x000001DCBF990000-0x000001DCBF9A0000-memory.dmp
memory/1896-131-0x000001DCBF900000-0x000001DCBF910000-memory.dmp
memory/1896-132-0x000001DCBF9A0000-0x000001DCBF9B0000-memory.dmp
memory/1896-135-0x000001DCBF910000-0x000001DCBF920000-memory.dmp
memory/1896-136-0x000001DCBF9B0000-0x000001DCBF9C0000-memory.dmp
memory/1896-139-0x000001DCBDC40000-0x000001DCBDC41000-memory.dmp
memory/1896-143-0x000001DCBF920000-0x000001DCBF930000-memory.dmp
memory/1896-144-0x000001DCBF930000-0x000001DCBF940000-memory.dmp
memory/1896-146-0x000001DCBDC40000-0x000001DCBDC41000-memory.dmp
memory/1896-147-0x000001DCBDC40000-0x000001DCBDC41000-memory.dmp
memory/1896-150-0x000001DCBF780000-0x000001DCBF790000-memory.dmp
memory/1896-149-0x000001DCBF770000-0x000001DCBF780000-memory.dmp
memory/1896-148-0x000001DCBF810000-0x000001DCBF820000-memory.dmp
memory/1896-153-0x000001DCBF7B0000-0x000001DCBF7C0000-memory.dmp
memory/1896-159-0x000001DCBF820000-0x000001DCBF830000-memory.dmp
memory/1896-175-0x000001DCBF940000-0x000001DCBF950000-memory.dmp
memory/1896-174-0x000001DCBF900000-0x000001DCBF910000-memory.dmp
memory/1896-173-0x000001DCBF8F0000-0x000001DCBF900000-memory.dmp
memory/1896-172-0x000001DCBF8E0000-0x000001DCBF8F0000-memory.dmp
memory/1896-171-0x000001DCBF8D0000-0x000001DCBF8E0000-memory.dmp
memory/1896-170-0x000001DCBF8C0000-0x000001DCBF8D0000-memory.dmp
memory/1896-169-0x000001DCBF8B0000-0x000001DCBF8C0000-memory.dmp
memory/1896-168-0x000001DCBF8A0000-0x000001DCBF8B0000-memory.dmp
memory/1896-167-0x000001DCBF890000-0x000001DCBF8A0000-memory.dmp
memory/1896-166-0x000001DCBF880000-0x000001DCBF890000-memory.dmp
memory/1896-165-0x000001DCBF870000-0x000001DCBF880000-memory.dmp
memory/1896-164-0x000001DCBF860000-0x000001DCBF870000-memory.dmp
memory/1896-163-0x000001DCBF850000-0x000001DCBF860000-memory.dmp
memory/1896-162-0x000001DCBF840000-0x000001DCBF850000-memory.dmp
memory/1896-161-0x000001DCBF830000-0x000001DCBF840000-memory.dmp
memory/1896-160-0x000001DCBF500000-0x000001DCBF770000-memory.dmp
memory/1896-158-0x000001DCBF800000-0x000001DCBF810000-memory.dmp
memory/1896-157-0x000001DCBF7F0000-0x000001DCBF800000-memory.dmp
memory/1896-156-0x000001DCBF7E0000-0x000001DCBF7F0000-memory.dmp
memory/1896-155-0x000001DCBF7D0000-0x000001DCBF7E0000-memory.dmp
memory/1896-154-0x000001DCBF7C0000-0x000001DCBF7D0000-memory.dmp
memory/1896-152-0x000001DCBF7A0000-0x000001DCBF7B0000-memory.dmp
memory/1896-151-0x000001DCBF790000-0x000001DCBF7A0000-memory.dmp
memory/1896-4-0x000001DCBF500000-0x000001DCBF770000-memory.dmp
memory/1896-16-0x000001DCBF780000-0x000001DCBF790000-memory.dmp
memory/1896-14-0x000001DCBF770000-0x000001DCBF780000-memory.dmp
memory/2900-252-0x000001DD76B70000-0x000001DD76B71000-memory.dmp
memory/2900-260-0x000001DD76B70000-0x000001DD76B71000-memory.dmp
memory/4832-218-0x000002BE55750000-0x000002BE55751000-memory.dmp