740cfea615830a7aea63a90b732e95c09babefc43a2859ec210a47c08e8ea709

Analysis

max time kernel
121s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
14-01-2023 12:58

Target

water corporation enterprise agreement 2018 wa 15722.js
Size

62KB
MD5

fbbd2ab87eb076d202e6bd929535c609
SHA1

b3627d701873263cf9a247e93dcbe5684ce65951
SHA256

d64d9cb448ff7dfea1e641471beae99893637de21f7801b2b45b1495b90b3088
SHA512

d7498b9ea9dd456ac49c074278a13257b74754ac074dbf49538e1177f8b864264a5872e0b948a3ad5578a39a0ee4cde99878e95c3c3e20ada2d6067982f36213
SSDEEP

768:v2ghJ5gba4sC/1a7Wuj2MgJlRhQMtUpoZEFNA/Ycik0aBZyxvDvl:/Aa4sFNK4MtA620y

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1348	poWERsHeLl.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	poWERsHeLl.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 564	672	taskeng.exe	29
PID 672 wrote to memory of 564	672	taskeng.exe	29
PID 672 wrote to memory of 564	672	taskeng.exe	29
PID 564 wrote to memory of 1812	564	wscript.EXE	30
PID 564 wrote to memory of 1812	564	wscript.EXE	30
PID 564 wrote to memory of 1812	564	wscript.EXE	30
PID 1812 wrote to memory of 1348	1812	cscript.exe	32
PID 1812 wrote to memory of 1348	1812	cscript.exe	32
PID 1812 wrote to memory of 1348	1812	cscript.exe	32

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\water corporation enterprise agreement 2018 wa 15722.js"
1⤵
PID:2024

C:\Windows\system32\taskeng.exe
taskeng.exe {04BCB898-156D-4B4F-9806-2BCD878CD6E7} S-1-5-21-3385717845-2518323428-350143044-1000:SABDUHNY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE BASEOF~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "BASEOF~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\poWERsHeLl.exe
      poWERsHeLl
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1348

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Identities\BASEOF~1.JS

Filesize
45.8MB

MD5
c791e98efebb37d4f5861dc17c164203

SHA1
3de1483dba5f2f9b450b2f4bc4df824408a42fae

SHA256
a08e56bdd9451f9afc0aebbbfabd500365a31ea1a4bc5b5d31505246adbf1394

SHA512
c20453b54ec3341adccc344c1a1143d4a0de157056ba86e1631f27d5d2e16358f94c5e1b54cc9bec3c277d8e1ed99b719a36d5f72827a0d6f4e701ab7b07d70d

Download Submit
memory/564-54-0x0000000000000000-mapping.dmp

Download
memory/1348-57-0x0000000000000000-mapping.dmp

Download
memory/1348-58-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download
memory/1348-59-0x000007FEF3F60000-0x000007FEF4983000-memory.dmp

Filesize
10.1MB

Download
memory/1348-61-0x0000000002584000-0x0000000002587000-memory.dmp

Filesize
12KB

Download
memory/1348-60-0x000007FEF3400000-0x000007FEF3F5D000-memory.dmp

Filesize
11.4MB

Download
memory/1348-62-0x000000000258B000-0x00000000025AA000-memory.dmp

Filesize
124KB

Download
memory/1348-63-0x0000000002584000-0x0000000002587000-memory.dmp

Filesize
12KB

Download
memory/1812-56-0x0000000000000000-mapping.dmp

Download