3da1cb0608f3709bf1331c4088fb258daf0200740b9b67afc6eec68a7f4b111a

Resubmissions

28-11-2022 19:20

28-11-2022 13:53

max time kernel
426s
max time network
431s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 19:20

Target

peseta/flours.js
Size

9KB
MD5

b6377f4364852191e440269dc0225850
SHA1

4784a7c288fbffaea4e5c10cfc2da208578977a2
SHA256

d0f396309db14bbe988e8ae6ba6dfb4451fc9db830484dcb7dec830b74d8467a
SHA512

302ab00ac77e86b3448bcf7affeb5e127e606d977556af0da17d211b816bc00b2d54643ceacf219f2c4be6532781e1d64db31d4a307ae822f9b70dc1617da7db
SSDEEP

192:CSLj5Uravgx685UIhpHKbP2KTMhS0OGYm9lWVjAvNzAWM5Evk7MgG+r5A0:N5Kk785UIhp/KTMhSeYmn2jiu5EjP+rV

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1560 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1560 powershell.exe

pid	process
1560	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1560	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1308 wrote to memory of 1560	1308	wscript.exe	powershell.exe
PID 1308 wrote to memory of 1560	1308	wscript.exe	powershell.exe
PID 1308 wrote to memory of 1560	1308	wscript.exe	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\peseta\flours.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass peseta\gratiae.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1308-54-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

Filesize
8KB

Download
memory/1560-55-0x0000000000000000-mapping.dmp

Download
memory/1560-57-0x000007FEF3C00000-0x000007FEF4623000-memory.dmp

Filesize
10.1MB

Download
memory/1560-58-0x000007FEF30A0000-0x000007FEF3BFD000-memory.dmp

Filesize
11.4MB

Download
memory/1560-59-0x00000000025C4000-0x00000000025C7000-memory.dmp

Filesize
12KB

Download
memory/1560-60-0x00000000025C4000-0x00000000025C7000-memory.dmp

Filesize
12KB

Download
memory/1560-61-0x00000000025CB000-0x00000000025EA000-memory.dmp

Filesize
124KB

Download