Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-01-2024 07:24

General

  • Target

    58537180c79b183f2a2fffc628907145.js

  • Size

    2KB

  • MD5

    58537180c79b183f2a2fffc628907145

  • SHA1

    18c814378f391ae133ff783465a4185bb5f83dc5

  • SHA256

    050100ddcb545d60a7d4c13c3279e968cdd7c8c0b23f7cf8bf7ac9bf16ed7173

  • SHA512

    73a4d1a85dfc9162e40c3634743a46ec54c924cdb2c8cbcd99fcf65755cc81c300de63c3d2d173b3750feeea978085d5ddd1d7f17aacc2e53ae20d51f7881079

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\58537180c79b183f2a2fffc628907145.js
    1⤵
      PID:2148
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:2592
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2524

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2524-0-0x0000024387A60000-0x0000024387A70000-memory.dmp

        Filesize

        64KB

      • memory/2524-16-0x0000024387B60000-0x0000024387B70000-memory.dmp

        Filesize

        64KB

      • memory/2524-32-0x000002438FED0000-0x000002438FED1000-memory.dmp

        Filesize

        4KB

      • memory/2524-34-0x000002438FF00000-0x000002438FF01000-memory.dmp

        Filesize

        4KB

      • memory/2524-35-0x000002438FF00000-0x000002438FF01000-memory.dmp

        Filesize

        4KB

      • memory/2524-36-0x0000024390010000-0x0000024390011000-memory.dmp

        Filesize

        4KB