a6379bc3a4f77d3edc69d9bfc40e355cba3347b333e43d8cf79bc77f1d691880

Analysis

max time kernel
226s
max time network
334s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:15

Target

fix/promoters.js
Size

131B
MD5

6fe9519aa99f2b3c90b196bf2f027e9f
SHA1

5f6005844a17a18381860a9096c7318661e700f3
SHA256

1511e81e0a5262e28fcea3228980cf3ab7dee93ca5e151c0b3ad1d4a2c64226d
SHA512

e3fd04269ba26072fa586a8d4c453941d8d3af7186c070f2b13483ac473571e0d9489eb5ae9dbc6a508f0f53900329ca0b5bdf9454a6a17ce6f0a95c9ffa6924

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1868 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1868 powershell.exe

pid	process
1868	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1868	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 540 wrote to memory of 1868	540	wscript.exe	powershell.exe
PID 540 wrote to memory of 1868	540	wscript.exe	powershell.exe
PID 540 wrote to memory of 1868	540	wscript.exe	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\fix\promoters.js
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass fix\detect.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1868

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/540-54-0x000007FEFC0B1000-0x000007FEFC0B3000-memory.dmp

Filesize
8KB

Download
memory/1868-55-0x0000000000000000-mapping.dmp

Download
memory/1868-57-0x000007FEF3D50000-0x000007FEF4773000-memory.dmp

Filesize
10.1MB

Download
memory/1868-59-0x00000000028D4000-0x00000000028D7000-memory.dmp

Filesize
12KB

Download
memory/1868-58-0x000007FEF31F0000-0x000007FEF3D4D000-memory.dmp

Filesize
11.4MB

Download
memory/1868-60-0x000000001B800000-0x000000001BAFF000-memory.dmp

Filesize
3.0MB

Download
memory/1868-61-0x00000000028D4000-0x00000000028D7000-memory.dmp

Filesize
12KB

Download
memory/1868-62-0x00000000028DB000-0x00000000028FA000-memory.dmp

Filesize
124KB

Download