Analysis
-
max time kernel
127s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
-
submitted
17-07-2023 14:12
General
-
Target
ac7886cc666943c2c5e44e3b87c60c7e0540454ba0b51c4bf2b7ea54c0fd083c.js
-
Size
763KB
-
MD5
9f008ed4394230c96e4d1ae70f01b637
-
SHA1
dd1108e83b22d21ba4b703472caaa162b1174928
-
SHA256
ac7886cc666943c2c5e44e3b87c60c7e0540454ba0b51c4bf2b7ea54c0fd083c
-
SHA512
b42d2a85209b8480d4a9d752d7622b5d2b4cbedfc5d8051a844583d1f1cbec3a763d556cd7626c446db84300a1b5ec041b105ffa52642d62a0d1de0e1e3eef6c
-
SSDEEP
12288:VVYBuZ0kC6mDEKZEA7S8m0N219zZH2LuLZEiUroOpqHCZFMHCcyZK5D2dBHEMBO4:VVYoukC6mDDZEA7SP9dWLuLZNOpqiZyk
Malware Config
Signatures
-
Blocklisted process makes network request 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ac7886cc666943c2c5e44e3b87c60c7e0540454ba0b51c4bf2b7ea54c0fd083c.js1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" rundll32 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\881777.dat,vcab /k zefirka7482⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\881777.dat,vcab /k zefirka7483⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
15KB
MD5e68f073d37edabf45079251f4405a668
SHA1e0f21d5e3988eca5af40d2b3956e429c81d8f676
SHA256dad087fe4005d639050a06b1e23a8b11c09bdf2acb812070588a1df940489d6a
SHA5123acd98af2a3b9de9d3c61521cadeee52d03023f405fdfa2cd562de8e0329e461dc3201830ef487c581eccef0fa09d0d5576cd22a4ce419a509a648fce7310dc9
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
9.9MB