fc82b563d313863573783df7d7b533da56a26e167db3a9143c7a780f1cab793d | Triage

Analysis

max time kernel
149s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-03-2023 21:38

Sharing

Report Analysis Logs

General

Target

$RECYCLE.BIN/$I4FIL8H.js
Size

544B
MD5

3bb5ddbbc15c65e6d7af1c41a877bf2f
SHA1

c9411803abd57b1c62936f7a973fde45b792a0f9
SHA256

73cfb6a30179d5759f151505756edd832bdfe6675424cdfef2d0d95b9265fe14
SHA512

6b3eacbd3de4c5ec44852cef7349062d206f3af35f6f315a9e57af6023ac3cd563bd4bfc3f1ce4a1ca69e394e2fd33bec7a7185bac289be7ac713bc24a497686

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1520	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1520	AUDIODG.EXE
Token: 33	1520	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1520	AUDIODG.EXE

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$I4FIL8H.js
1⤵
PID:1240

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:980

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x568
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2024

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" shell32.dll,Options_RunDLL 7
1⤵
PID:924

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$I4FIL8H.js
1⤵
PID:2000

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$R4FIL8H.js
1⤵
PID:976

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$R5VEPRW.js
1⤵
PID:1752

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$RMH8R2U.js
1⤵
PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads