740cfea615830a7aea63a90b732e95c09babefc43a2859ec210a47c08e8ea709

Analysis

max time kernel
129s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
14/01/2023, 13:33

Target

water corporation enterprise agreement 2018 wa 15722.js
Size

62KB
MD5

fbbd2ab87eb076d202e6bd929535c609
SHA1

b3627d701873263cf9a247e93dcbe5684ce65951
SHA256

d64d9cb448ff7dfea1e641471beae99893637de21f7801b2b45b1495b90b3088
SHA512

d7498b9ea9dd456ac49c074278a13257b74754ac074dbf49538e1177f8b864264a5872e0b948a3ad5578a39a0ee4cde99878e95c3c3e20ada2d6067982f36213
SSDEEP

768:v2ghJ5gba4sC/1a7Wuj2MgJlRhQMtUpoZEFNA/Ycik0aBZyxvDvl:/Aa4sFNK4MtA620y

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1936	poWERsHeLl.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	poWERsHeLl.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 752	568	taskeng.exe	29
PID 568 wrote to memory of 752	568	taskeng.exe	29
PID 568 wrote to memory of 752	568	taskeng.exe	29
PID 752 wrote to memory of 1176	752	wscript.EXE	30
PID 752 wrote to memory of 1176	752	wscript.EXE	30
PID 752 wrote to memory of 1176	752	wscript.EXE	30
PID 1176 wrote to memory of 1936	1176	cscript.exe	32
PID 1176 wrote to memory of 1936	1176	cscript.exe	32
PID 1176 wrote to memory of 1936	1176	cscript.exe	32

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\water corporation enterprise agreement 2018 wa 15722.js"
1⤵
PID:1504

C:\Windows\system32\taskeng.exe
taskeng.exe {B5F9A29A-423D-4166-8462-A82A7FBE9B97} S-1-5-21-3385717845-2518323428-350143044-1000:SABDUHNY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE BASEOF~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "BASEOF~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\poWERsHeLl.exe
      poWERsHeLl
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1936

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Identities\BASEOF~1.JS

Filesize
45.8MB

MD5
41df636ceaae7100d4258637118ad9a9

SHA1
37585bd87ec0020eb38704d6abbcf482a2dd22d8

SHA256
8aa139827b549aa780ab80619dab2324c2f76ed5354f8d2df7b3e6f523b99209

SHA512
601a06ae573636962f246f205e7867bd91e850ea18145616a271b12080be09a553ea0c9618a54ea908fe45cda24d6afae239126a12d71fec3ceb275e3d5a94a5

Download Submit
memory/1936-58-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download
memory/1936-59-0x000007FEF3ED0000-0x000007FEF48F3000-memory.dmp

Filesize
10.1MB

Download
memory/1936-61-0x0000000002914000-0x0000000002917000-memory.dmp

Filesize
12KB

Download
memory/1936-60-0x000007FEF3370000-0x000007FEF3ECD000-memory.dmp

Filesize
11.4MB

Download
memory/1936-62-0x000000000291B000-0x000000000293A000-memory.dmp

Filesize
124KB

Download
memory/1936-63-0x0000000002914000-0x0000000002917000-memory.dmp

Filesize
12KB

Download