Overview
overview
3Static
static
masam/about-us.html
windows7_x64
1masam/about-us.html
windows10_x64
1masam/asse...y.html
windows7_x64
1masam/asse...y.html
windows10_x64
1masam/asse...vg.xml
windows7_x64
1masam/asse...vg.xml
windows10_x64
1masam/asse...vg.xml
windows7_x64
1masam/asse...vg.xml
windows10_x64
1masam/asse...vg.xml
windows7_x64
1masam/asse...vg.xml
windows10_x64
1masam/asse...vg.xml
windows7_x64
1masam/asse...vg.xml
windows10_x64
1masam/asse...pg.ps1
windows7_x64
1masam/asse...pg.ps1
windows10_x64
3masam/asse...pg.ps1
windows7_x64
1masam/asse...pg.ps1
windows10_x64
3masam/asse...min.js
windows7_x64
1masam/asse...min.js
windows10_x64
1masam/asse...ear.js
windows7_x64
1masam/asse...ear.js
windows10_x64
1masam/asse...min.js
windows7_x64
1masam/asse...min.js
windows10_x64
1masam/asse...ess.js
windows7_x64
1masam/asse...ess.js
windows10_x64
1masam/asse...aps.js
windows7_x64
1masam/asse...aps.js
windows10_x64
1masam/asse...ope.js
windows7_x64
1masam/asse...ope.js
windows10_x64
1masam/asse...tTo.js
windows7_x64
1masam/asse...tTo.js
windows10_x64
1masam/asse...box.js
windows7_x64
1masam/asse...box.js
windows10_x64
1Analysis
-
max time kernel
24s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-08-2021 05:33
Static task
static1
Behavioral task
behavioral1
Sample
masam/about-us.html
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral2
Sample
masam/about-us.html
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral3
Sample
masam/assets/css/owl.video.play.html
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral4
Sample
masam/assets/css/owl.video.play.html
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral5
Sample
masam/assets/fonts/Flaticon.svg.xml
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral6
Sample
masam/assets/fonts/Flaticon.svg.xml
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral7
Sample
masam/assets/fonts/fa-brands-400.svg.xml
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral8
Sample
masam/assets/fonts/fa-brands-400.svg.xml
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral9
Sample
masam/assets/fonts/fa-regular-400.svg.xml
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral10
Sample
masam/assets/fonts/fa-regular-400.svg.xml
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral11
Sample
masam/assets/fonts/fa-solid-900.svg.xml
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral12
Sample
masam/assets/fonts/fa-solid-900.svg.xml
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral13
Sample
masam/assets/images/banner/slider-1.jpg.ps1
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral14
Sample
masam/assets/images/banner/slider-1.jpg.ps1
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral15
Sample
masam/assets/images/banner/slider-3.jpg.ps1
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral16
Sample
masam/assets/images/banner/slider-3.jpg.ps1
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral17
Sample
masam/assets/js/TweenMax.min.js
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral18
Sample
masam/assets/js/TweenMax.min.js
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral19
Sample
masam/assets/js/appear.js
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral20
Sample
masam/assets/js/appear.js
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral21
Sample
masam/assets/js/bootstrap.min.js
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral22
Sample
masam/assets/js/bootstrap.min.js
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral23
Sample
masam/assets/js/circle-progress.js
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral24
Sample
masam/assets/js/circle-progress.js
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral25
Sample
masam/assets/js/gmaps.js
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral26
Sample
masam/assets/js/gmaps.js
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral27
Sample
masam/assets/js/isotope.js
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral28
Sample
masam/assets/js/isotope.js
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral29
Sample
masam/assets/js/jquery.countTo.js
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral30
Sample
masam/assets/js/jquery.countTo.js
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral31
Sample
masam/assets/js/jquery.fancybox.js
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral32
Sample
masam/assets/js/jquery.fancybox.js
Resource
win10v20210408
windows10_x64
General
-
Target
masam/assets/images/banner/slider-3.jpg.ps1
-
Size
305KB
-
MD5
d4641d37d52119ebd3055b1d61fc44da
-
SHA1
a30508de242c0805d3114c7e5430d9a1ddec622c
-
SHA256
55308ec5b07983fe0c5eecc4ae58066e9b5575a53c1d38587bb29b64851c6231
-
SHA512
d2c6858462cd3a410b41e1b57ab47d1cc7dcfc4a1c108ad95b7820156ab52fe8d92fc32973311bd8981e3f5c7dec16c05862269fa6f0166807e58f37e0d86e5d
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2960 808 WerFault.exe 67 -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 808 powershell.exe 808 powershell.exe 808 powershell.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 808 powershell.exe Token: SeDebugPrivilege 2960 WerFault.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\masam\assets\images\banner\slider-3.jpg.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 808 -s 19682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960
-