faacab70e93599e4bd87bb16be40e6aab5034e913986aa11aa6392f3c4e7af6f

Analysis

max time kernel
38s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 20:28

Target

fix/collapses.js
Size

132B
MD5

a7ed5526d693f7ec3c6a25d2860a8448
SHA1

a7e481e4eb45adc0675023f042a600292bcb6293
SHA256

a338a607c99311a3c1e3bdf4530a419b4217599e0fcd276c02191056154c3be1
SHA512

8c5ff00a934b75f8c38cc3218e635bd42e7f3088f17daaf5ad935082ab8e3c4cc8d47bd6325d5683b074d0037da1e3ae6044043a3ae3c6aa4d7242e5e0378cbd

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1660 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1660 powershell.exe

pid	process
1660	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1660	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 844 wrote to memory of 1660	844	wscript.exe	powershell.exe
PID 844 wrote to memory of 1660	844	wscript.exe	powershell.exe
PID 844 wrote to memory of 1660	844	wscript.exe	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\fix\collapses.js
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass fix\archery.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1660

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/844-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Filesize
8KB

Download
memory/1660-55-0x0000000000000000-mapping.dmp

Download
memory/1660-57-0x000007FEF3D20000-0x000007FEF4743000-memory.dmp

Filesize
10.1MB

Download
memory/1660-58-0x000007FEF2F20000-0x000007FEF3A7D000-memory.dmp

Filesize
11.4MB

Download
memory/1660-59-0x0000000002484000-0x0000000002487000-memory.dmp

Filesize
12KB

Download
memory/1660-60-0x000000000248B000-0x00000000024AA000-memory.dmp

Filesize
124KB

Download