Http Www.jmp.com Software Trial Reply Download.shtml Snum Qc0356000y&os Mac Updated

Minnie Hatesel April 21, 2022

Http Www.jmp.com Software Trial Reply Download.shtml Snum Qc0356000y&os Mac

Incident Response

MITRE ATT&CK™ Techniques Detection

This study has 3 indicators that were mapped to 4 attack techniques and 4 tactics. View all details

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

  • Installation/Persistance
    • Constitute an indicator for a scheduled task trigger
      details
      "on_Script-Run_Once - Run and Delete itself on get-go Internet Contact</Description>
      <URI>\Online_KMS_Activation_Script-Run_Once</URI>
      <SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FRFX;;;LS)(A;;FRFW;;;South-one-5-lxxx-123231216-2592883651-3715271367-3753151631-4175906628)(A;;FR;;;South-i-five-4)</SecurityDescriptor>
      </RegistrationInfo>
      <Triggers>
      <LogonTrigger>
      <Enabled>true</Enabled>
      </LogonTrigger>
      </Triggers>
      <Principals>
      <Principal id="LocalSystem">
      <UserId>S-1-5-eighteen</UserId>
      <RunLevel>HighestAvailable</RunLevel>
      </Chief>
      </Principals>
      <Settings>
      <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
      <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
      <StopIfGoingOnBatteries>faux</StopIfGoingOnBatteries>
      <AllowHardTerminate>truthful</AllowHardTerminate>
      <StartWhenAvailable>truthful</StartWhenAvailable>
      <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
      <IdleSettings>
      <StopOnIdleEnd>fal" (Indicator: "LogonTrigger"; File: "19091c019430222185384a4eb4aa1299d5ee775e174facbd80d62827040959e9.cmd.bin")
      "<LogonTrigger>" (Indicator: "LogonTrigger"; File: "19091c019430222185384a4eb4aa1299d5ee775e174facbd80d62827040959e9.cmd.bin")
      "</LogonTrigger>" (Indicator: "LogonTrigger"; File: "19091c019430222185384a4eb4aa1299d5ee775e174facbd80d62827040959e9.cmd.bin")
      source
      String
      relevance
      5/ten
      ATT&CK ID
      T1168 (Show technique in the MITRE ATT&CK™ matrix)
  • External Systems
  • Full general
    • Found a potential E-Mail address in binary/memory
      details
      Pattern friction match: "t6s@w.6ygm"
      Pattern match: "eastward@j3krzc8tx.u96ck"
      Pattern match: "azslqj@_rkm9.i"
      Design match: "i30@i4i.mead8"
      Pattern match: "zmpjv@v2srbu3fg.e4g"
      Pattern match: "9lr@.bojpe0apfn9.srsfw0ad"
      Pattern lucifer: "ii@b.3ci"
      Pattern friction match: "jec@ug1lu..vztbkiaypu"
      Blueprint friction match: "s@qlsm.hrod1"
      Pattern match: "or@eight.fr"
      Blueprint match: "yard-rf7n@qdv.pwey"
      Design friction match: "k@tu.3p1"
      Pattern friction match: "kag6z@lu02kokh.4j"
      Pattern friction match: "v@se._c"
      Pattern match: "5b@ddcspsw.0"
      Pattern match: "7aordyk@u8k.omd2"
      Design match: "xz_l@t.i6"
      Pattern match: "pl_@df.pwv"
      Pattern match: "l3@zqoa.6eh"
      Pattern match: "u1u@j.wy"
      source
      Cord
      relevance
      3/10
      ATT&CK ID
      T1114 (Show technique in the MITRE ATT&CK™ matrix)
  • Network Related
    • Found potential IP address in binary/retention
      details
      Heuristic match: "::set KMS_IP=172.16.0.two"
      Heuristic friction match: "wmic path %spp% where ID='%1' call SetKeyManagementServiceMachine MachineName="127.0.0.2" %_Nul_1_2%"
      source
      String
      relevance
      3/ten
  • Remote Access Related
    • Contains indicators of bot advice commands
      details
      "if defined Run_Once Get out 1651565635 & Rem Dummy Numbers To Show Error In Chore
      echo.
      intermission
      goto:EOF
      )
      echo Waiting 30 due south&timeout /t 30>nul
      set /a loop=%loop%+ane
      goto echo
      )
      repeat Internet is continued.
      echo.

      :: ----------------------------------------------
      :: Multi KMS servers integration and ping test
      :: Written by @RPO (MDL)
      :: ----------------------------------------------

      ::========================================================================================================================================
      REM - Servers_List - You tin edit the Online KMS Servers in beneath line, Brand sure to leave a space betwixt the servers name.

      set "servers=kms.digiboy.ir kms.mrxn.net kms8.MSGuides.com kms9.MSGuides.com kms.chinancce.com kms.library.hk kms.03k.org kms.digiboy.ir"

      ::========================================================================================================================================

      set up northward=ane&for %%a in (%servers%) exercise" (Indicator: "servers=")
      "(prepare server[!n!]=%%a&ready /A n+=ane)&set /a max_servers=!due north!-1
      prepare server_num=i
      :server
      gear up /a activation_ok=i
      if %server_num% gtr !max_servers! (
      if defined Renewal_Task (echo No KMS server available. Exiting...&exit 1651565635 rem Dummy Numbers To Show Fault In Task)
      if defined Run_Once (echo No KMS server bachelor. Exiting...&exit 1651565635 rem Dummy Numbers To Bear witness Fault In Job)
      echo No KMS server available, & suspension & goto:EOF)

      gear up KMS_IP=!server[%server_num%]!

      echo Trying with KMS server: %KMS_IP%
      ping %KMS_IP% -n 1 -westward 20000 > nul || (
      echo Ping test is unsuccessful.
      set /a server_num+=1
      goto :server
      )
      echo Ping test is successful.

      ::========================================================

      cd /d "%~dp0"
      IF /I "%PROCESSOR_ARCHITECTURE%" EQU "AMD64" (ready xOS=x64) else (set xOS=Win32)
      for /f "tokens=half dozen delims=[]. " %%Grand in ('ver') do set winbuild=%%M
      if %winbuild% GEQ 9600 (
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Plat" (Indicator: "servers="), "set "servers=kms.digiboy.ir kms.mrxn.net kms8.MSGuides.com kms9.MSGuides.com kms.chinancce.com kms.library.hk kms.03k.org kms.digiboy.ir"" (Indicator: "servers="), "fix n=one&for %%a in (%servers%) do (set server[!n!]=%%a&set /A n+=one)&prepare /a max_servers=!north!-1" (Indicator: "servers=")

      source
      String
      relevance
      10/ten
      ATT&CK ID
      T1094 (Show technique in the MITRE ATT&CK™ matrix)
  • External Systems
  • Installation/Persistance
    • Opens the MountPointManager (ofttimes used to detect additional infection locations)
      details
      "wscript.exe" opened "\Device\MountPointManager"
      source
      API Call
      relevance
      5/ten
    • Touches files in the Windows directory
      details
      "wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
      "wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
      "wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
      "wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
      "wscript.exe" touched file "%WINDIR%\System32\en-US\jscript.dll.mui"
      "wscript.exe" touched file "%WINDIR%\Fonts\StaticCache.dat"
      "wscript.exe" touched file "%WINDIR%\System32\en-United states of america\msctf.dll.mui"
      source
      API Phone call
      relevance
      7/10
  • Network Related
    • Plant potential URL in binary/memory
      details
      Blueprint match: "https://www.crackshash.com/"
      Pattern match: "https://forums.mydigitallife.net/posts/1479105"
      Pattern lucifer: "https://www.nsaneforums.com/topic/312871--/"
      Blueprint match: "https://due south.put.re/9j71eomM.7z"
      Design friction match: "https://github.com/AveYo/Compressed2TXT"
      Pattern match: "https://gitlab.com/angelkyo/w10-digitallicense"
      Pattern lucifer: "https://s.put.re/aiYbFHiP.7z"
      Blueprint friction match: "https://stackoverflow.com/a/12264592/1016343"
      Pattern match: "www.crackshash.com"
      Pattern match: "https://forums.mydigitallife.net/posts/1150042"
      Design match: "https://forums.mydigitallife.net/posts/838808"
      Pattern match: "https://forums.mydigitallife.net/posts/1479890"
      Pattern match: "https://tb.rg-adguard.cyberspace"
      Pattern match: "https://www.softpedia.com/get/System/Back-up-and-Recovery/SVF-eXtractor.shtml"
      Pattern match: "https://genuineisoverifier.weebly.com/"
      Pattern match: "https://androidhost.org/get/E5jX7Pv"
      Pattern match: "https://forums.mydigitallife.cyberspace/posts/1466365"
      Pattern lucifer: "https://tinyurl.com/ydedarpl"
      Design match: "https://github.com/abbodi1406/WHD/raw/principal/scripts/Clear-KMS-Cache.nada"
      Pattern friction match: "https://world wide web.nsaneforums.com/topic/316668--/"
      Pattern match: "www.google.com"
      Pattern match: "https://forums.mydigitallife.net/posts/1221231"
      Blueprint match: "http://schemas.microsoft.com/windows/2004/02/mit/task"
      Pattern match: "P6Y004jh00000000000000000000000000E.7a..Ktt/s5{u000000H-3ky7JZmfFu9^fB,mh000000000000000000000000000000000010M]z30NmCA"
      Pattern match: "https://github.com/vyvojar/slshim/releases"
      Design match: "https://tinyurl.com/y928qd8p"
      Blueprint friction match: "https://tinyurl.com/y86za5zq"
      Pattern match: "0x0.st/s9j"
      Pattern match: "https://southward.put.re/WFuXpyWA.zip"
      Pattern friction match: "https://stackoverflow.com/users/1016343/matt"
      Pattern match: "https://pastebin.com/raw/Hk2RgYzF"
      Pattern friction match: "https://forums.mydigitallife.net/threads/77028"
      Design match: "https://rutracker.org/forum/viewtopic.php?t=5489573"
      Blueprint match: "https://msdn.rg-adguard.net/"
      Design friction match: "https://vlsc.rg-adguard.cyberspace/"
      Pattern lucifer: "https://sha1.rg-adguard.internet/"
      Design match: "https://forums.mydigitallife.net/threads/78070/"
      Pattern match: "http://www.heidoc.net/php/myvsdump.php"
      Pattern lucifer: "https://github.com/gurnec/HashCheck/releases/latest"
      Pattern match: "https://due south.put.re/ah9FW2gh.7z"
      Heuristic friction match: "kms.digiboy.ir"
      Heuristic match: "kms.mrxn.cyberspace"
      Heuristic friction match: "kms8.MSGuides.com"
      Heuristic match: "kms9.MSGuides.com"
      Heuristic friction match: "kms.chinancce.com"
      Heuristic match: "kms.library.hk"
      Heuristic match: "kms.03k.org"
      Pattern match: "e.hyf/(^Tf3xK_#Rg|ok)R{87y@wD|[/I@Ity&Y/n0phA#/?p]2FXH=Itg^bB_nNf56J_F}&2+Cz"
      Pattern match: "b.VdT/?sfB1"
      Pattern friction match: "Pop.XY/Tu4w?I*!_BHigy5CoztLQkSu.8iv6LDmu,KBgg4a"
      Heuristic match: "::+JP?z.&9k3(Sq_p)@;Y@PR.#CVMm8enVq]|(@!gbO=WZ#dZ!/sEs9hjznRHXAy8(d;WfaauCCa1_B@5}mnw~uJsaDpi8^V(su34TOem(,R;##i&4ZjdRr}iOYe.dO"
      Blueprint match: "m.CvRK/@vXrSxO"
      Heuristic match: "::rFDB8eoAA@@tdJCCveNL7]O/kHyLF@5vSfc{6?D(Y1]S*qwl/=8a3&#r8f9I6@mtI&Dvd.xJr28z@AXQ0^A-Y6Gy.n4hHT[Px3Bfogl#JaH_WyRCm3/ophPnF_.MG"
      Pattern match: "jb11JfX.XnuX/aF=da&K_7R88H/[a^b7/A7"
      Pattern friction match: "WiO7yU.Kxc/7HFamej[B"
      Blueprint match: "-.jB/,|d.k"
      Heuristic lucifer: "::Au?r*United nations~-8uBwRyVv!Uv3q6A#QEh6r&_vYK6jfS7YQD[R4d)X6+?DpNLnd[JB[bP2hHKv39k4+AWcnp=7}U[vii/2pc]7Dvvb20X/SzZm0K)TEGWma~d;st{~Tw).MC"
      Pattern match: "f7.z0x1C.NWy/c~Due west,O6xxC*}Ej#2M?u@dq|B+vRN[One thousand.N{2TgMmlOI3s0GgArEJ.sYS"
      Pattern match: "Yard..CQ/1091c2.27kY56@tGbf"
      Pattern match: "73g3.Kxi//AKK}p}dTSWnMLxO&"
      Pattern match: "EvRWDr.EM/kLoe?kuJEW"
      source
      String
      relevance
      10/ten
  • Unusual Characteristics
    • Found reference to Diagnosis CAB file
      details
      "r. You can discover it here https://s.put.re/aiYbFHiP.7z

      Information technology contains following files, which are extracted to %temp% folder in 'Convert Retail Function to
      VL' option.

      C2R-R2V/
      checksums.sha1 297 bytes 65ce5885e59677aa3372ee3786ca6572100b39af VT = 0/54
      x64/
      cleanospp.exe 19.5 KB d30a0e4e5911d3ca705617d17225372731c770e2 VT = 0/70
      msvcr100.dll 809 KB b7b9349b33230c5b80886f5c1f0a42848661c883 VT = 0/69
      x86/
      cleanospp.exe 17.0 KB 39ed8659e7ca16aaccb86def94ce6cec4c847dd6 VT = 0/70
      key.vbs iii.62 KB 0d526d8cf9f4c3b5fdbcc7cdf7707eedc9b7aff8 VT = one/56
      msvcr100.dll 755 KB 0b51fb415ec89848f339f8989d323bea722bfd70 VT = 0/69

      Total size = i.56 MB
      Total size in compressed text = 810 KB

      File sources -
      cleanospp.exe and msvcr100.dll come from the 'one-time' version of Microsoft Tool O15CTRRemove.diagcab
      You tin get the original file here https://s.put.re/WFuXpyWA.cipher

      ----------------------------------" (Indicator: ".diagcab")
      "cleanospp.exe and msvcr100.dll come up from the 'sometime' version of Microsoft Tool O15CTRRemove.diagcab" (Indicator: ".diagcab")

      source
      String
      relevance
      seven/10

File Details

All Details:

MAS_0.6_CRC32_656492C8 {CracksHash}.cmd

Filename
MAS_0.6_CRC32_656492C8 {CracksHash}.cmd
Size
1.9MiB (2037820 bytes)
Type
script javascript
Description
DOS batch file, ASCII text, with CRLF line terminators
Compages
WINDOWS
SHA256
19091c019430222185384a4eb4aa1299d5ee775e174facbd80d62827040959e9 Copy SHA256 to clipboard

Nomenclature (TrID)

  • 100.0% (.BIB/BIBTEX/TXT) BibTeX references

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process beneath to view more details.

Analysed one procedure in full.

  • wscript.exe "C:\MAS_0.6_CRC32_656492C8_CracksHash_.cmd.js" (PID: 3352)

Network Analysis

DNS Requests

No relevant DNS requests were made.

HTTP Traffic

No relevant HTTP requests were made.

Extracted Files

No significant files were extracted.

Notifications

  • Network whitenoise filtering (Procedure) was practical
  • No static analysis parsing on sample was performed
  • Not all IP/URL string resource were checked online
  • Non all sources for indicator ID "string-63" are bachelor in the report
  • Not all strings are visible in the report, because the maximum number of strings was reached (5000)

Http Www.jmp.com Software Trial Reply Download.shtml Snum Qc0356000y&os Mac

Posted by: carolthood1940.blogspot.com

Post a Comment

0 Comments