Overview
overview
10Static
static
72d369c8fd7...ea.apk
android-9-x86
102d369c8fd7...ea.apk
android-10-x64
102d369c8fd7...ea.apk
android-11-x64
10ad.html
windows7-x64
1ad.html
windows10-2004-x64
1disney.js
windows7-x64
1disney.js
windows10-2004-x64
1googlephoto.js
windows7-x64
1googlephoto.js
windows10-2004-x64
1hbomax.js
windows7-x64
1hbomax.js
windows10-2004-x64
1netflix.js
windows7-x64
1netflix.js
windows10-2004-x64
1web.js
windows7-x64
1web.js
windows10-2004-x64
1Analysis
-
max time kernel
138s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
2d369c8fd70cb536d9a80714cd1b89e28a811dc07da92694b41de4643f3e1cea.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
2d369c8fd70cb536d9a80714cd1b89e28a811dc07da92694b41de4643f3e1cea.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral3
Sample
2d369c8fd70cb536d9a80714cd1b89e28a811dc07da92694b41de4643f3e1cea.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral4
Sample
ad.html
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
ad.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral6
Sample
disney.js
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
disney.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
googlephoto.js
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
googlephoto.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
hbomax.js
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
hbomax.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
netflix.js
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
netflix.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
web.js
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
web.js
Resource
win10v2004-20230915-en
General
-
Target
googlephoto.js
-
Size
2KB
-
MD5
7b1a437a30d1e6cc57005f68ff3ebc6e
-
SHA1
ee034f7775b557972a234bd5ac522d42f8188429
-
SHA256
a2c555744ba3fb6a86b49bb2e98be947ace5ce5d68603143ae9c8c4ee44255c6
-
SHA512
6774005e468dd5a0b14fc7709cfa9e5bfa587cdad91cac76c0ac0ec8e738a953d191190467182a8a6c9e7a0a4bb434fd3d9aa29c6edef550db8f287d5d181545
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 2092 svchost.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\googlephoto.js1⤵PID:1476
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:1008
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2092