e55f78dc679c0246702846641703c48e76f292f5d8fb18696b52008ac753420c

Analysis

max time kernel
10s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 14:57

Target

fix/terrines.js
Size

132B
MD5

28048969a3d56e40a9d773ba8248044b
SHA1

1dc77ffe2f01911f72b4bb53ed1ba2718fa1a460
SHA256

8e6917eda43d25d78bb4f140a689572e02152b7e0b8be6ca509fb51fed4cb9fb
SHA512

20b5979c8294431bfc7b4b5c94ac5d7a1ba33f996c808fce06a967085e625963665d83cd80c3861370be919229c47146ef85eaebe6901f1b0846295b30c194ef

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1092 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1092 powershell.exe

pid	process
1092	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1092	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1772 wrote to memory of 1092	1772	wscript.exe	powershell.exe
PID 1772 wrote to memory of 1092	1772	wscript.exe	powershell.exe
PID 1772 wrote to memory of 1092	1772	wscript.exe	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\fix\terrines.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass fix\slammed.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1092

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1092-55-0x0000000000000000-mapping.dmp

Download
memory/1092-57-0x000007FEF3D60000-0x000007FEF4783000-memory.dmp

Filesize
10.1MB

Download
memory/1092-58-0x000007FEF3200000-0x000007FEF3D5D000-memory.dmp

Filesize
11.4MB

Download
memory/1092-59-0x0000000002934000-0x0000000002937000-memory.dmp

Filesize
12KB

Download
memory/1092-60-0x000000001B6F0000-0x000000001B9EF000-memory.dmp

Filesize
3.0MB

Download
memory/1092-61-0x0000000002934000-0x0000000002937000-memory.dmp

Filesize
12KB

Download
memory/1092-62-0x000000000293B000-0x000000000295A000-memory.dmp

Filesize
124KB

Download
memory/1772-54-0x000007FEFB8E1000-0x000007FEFB8E3000-memory.dmp

Filesize
8KB

Download