Analysis
- max time kernel
128s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2023, 11:17
Static task
static1
Behavioral task
behavioral1
Sample
ProjectFunding_547624_Jun01.js
Resource
win7-20230220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ProjectFunding_547624_Jun01.js
Resource
win10v2004-20230220-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target ProjectFunding_547624_Jun01.js
- Size 1KB
- Sample230602-nd22csbe3w
- SHA256 3290ebf23a0f763607fa8c7a64b84da516d015adf663380dea9bf5ac19929543
- MD5 d958dec890f5a49330457862991ebee0
- SHA1 46fae61a6d8ccaa4cd07f0e25fb7285024f8e36c
- SHA512 d6d64699bd29586111573bb7e32bded0dfd48bca63ea9c87517f53f9eab22e3744e81f433f38ffc15dfe388564993bf4069a82e53fa04e748996a4cbfeab4d67
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 6 IoCs
flow pid Process 6 1472 msiexec.exe 32 1472 msiexec.exe 62 1472 msiexec.exe 64 1472 msiexec.exe 70 1472 msiexec.exe 72 1472 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1808 wscript.exe Token: SeIncreaseQuotaPrivilege 1808 wscript.exe Token: SeSecurityPrivilege 1472 msiexec.exe Token: SeCreateTokenPrivilege 1808 wscript.exe Token: SeAssignPrimaryTokenPrivilege 1808 wscript.exe Token: SeLockMemoryPrivilege 1808 wscript.exe Token: SeIncreaseQuotaPrivilege 1808 wscript.exe Token: SeMachineAccountPrivilege 1808 wscript.exe Token: SeTcbPrivilege 1808 wscript.exe Token: SeSecurityPrivilege 1808 wscript.exe Token: SeTakeOwnershipPrivilege 1808 wscript.exe Token: SeLoadDriverPrivilege 1808 wscript.exe Token: SeSystemProfilePrivilege 1808 wscript.exe Token: SeSystemtimePrivilege 1808 wscript.exe Token: SeProfSingleProcessPrivilege 1808 wscript.exe Token: SeIncBasePriorityPrivilege 1808 wscript.exe Token: SeCreatePagefilePrivilege 1808 wscript.exe Token: SeCreatePermanentPrivilege 1808 wscript.exe Token: SeBackupPrivilege 1808 wscript.exe Token: SeRestorePrivilege 1808 wscript.exe Token: SeShutdownPrivilege 1808 wscript.exe Token: SeDebugPrivilege 1808 wscript.exe Token: SeAuditPrivilege 1808 wscript.exe Token: SeSystemEnvironmentPrivilege 1808 wscript.exe Token: SeChangeNotifyPrivilege 1808 wscript.exe Token: SeRemoteShutdownPrivilege 1808 wscript.exe Token: SeUndockPrivilege 1808 wscript.exe Token: SeSyncAgentPrivilege 1808 wscript.exe Token: SeEnableDelegationPrivilege 1808 wscript.exe Token: SeManageVolumePrivilege 1808 wscript.exe Token: SeImpersonatePrivilege 1808 wscript.exe Token: SeCreateGlobalPrivilege 1808 wscript.exe Token: SeShutdownPrivilege 1808 wscript.exe Token: SeIncreaseQuotaPrivilege 1808 wscript.exe Token: SeCreateTokenPrivilege 1808 wscript.exe Token: SeAssignPrimaryTokenPrivilege 1808 wscript.exe Token: SeLockMemoryPrivilege 1808 wscript.exe Token: SeIncreaseQuotaPrivilege 1808 wscript.exe Token: SeMachineAccountPrivilege 1808 wscript.exe Token: SeTcbPrivilege 1808 wscript.exe Token: SeSecurityPrivilege 1808 wscript.exe Token: SeTakeOwnershipPrivilege 1808 wscript.exe Token: SeLoadDriverPrivilege 1808 wscript.exe Token: SeSystemProfilePrivilege 1808 wscript.exe Token: SeSystemtimePrivilege 1808 wscript.exe Token: SeProfSingleProcessPrivilege 1808 wscript.exe Token: SeIncBasePriorityPrivilege 1808 wscript.exe Token: SeCreatePagefilePrivilege 1808 wscript.exe Token: SeCreatePermanentPrivilege 1808 wscript.exe Token: SeBackupPrivilege 1808 wscript.exe Token: SeRestorePrivilege 1808 wscript.exe Token: SeShutdownPrivilege 1808 wscript.exe Token: SeDebugPrivilege 1808 wscript.exe Token: SeAuditPrivilege 1808 wscript.exe Token: SeSystemEnvironmentPrivilege 1808 wscript.exe Token: SeChangeNotifyPrivilege 1808 wscript.exe Token: SeRemoteShutdownPrivilege 1808 wscript.exe Token: SeUndockPrivilege 1808 wscript.exe Token: SeSyncAgentPrivilege 1808 wscript.exe Token: SeEnableDelegationPrivilege 1808 wscript.exe Token: SeManageVolumePrivilege 1808 wscript.exe Token: SeImpersonatePrivilege 1808 wscript.exe Token: SeCreateGlobalPrivilege 1808 wscript.exe Token: SeShutdownPrivilege 1808 wscript.exe - Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ProjectFunding_547624_Jun01.js1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1808
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1472