f35301fcb3edde8a90404e76db02f676aef3f34e7bd75f8a957db6b8dec51ff9

Resubmissions

05-03-2024 21:12

240305-z2k9ashe4x 8

05-03-2024 21:11

240305-z133qahe3w 8

05-03-2024 21:08

240305-zy3zyahd5y 8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.js
Size

10KB
MD5

7ecd581e9849950f709e4ea9e46d645e
SHA1

d640066d18821dace39d943d5f0188b063ac1c2b
SHA256

f35301fcb3edde8a90404e76db02f676aef3f34e7bd75f8a957db6b8dec51ff9
SHA512

72b53af2a358c1e055a5a835373a9f093563a5cad8151fd81e0e5713e611b2224d6dcf7ceecd7ddfb4aa33ce28029fdaed584a59862ba548a7ced2f1761defe0
SSDEEP

192:wsCoBnxfrY7wKSvhfen6uFT4xnQ8doGBVLL41nROZewQj5W:wZoBx87dkWnLl4t8eL4nFwQE

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2628	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2628	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 1116	2748	wscript.exe	28
PID 2748 wrote to memory of 1116	2748	wscript.exe	28
PID 2748 wrote to memory of 1116	2748	wscript.exe	28
PID 1116 wrote to memory of 2628	1116	cscript.exe	30
PID 1116 wrote to memory of 2628	1116	cscript.exe	30
PID 1116 wrote to memory of 2628	1116	cscript.exe	30

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\1.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "1.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-4-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2628-5-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2628-6-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/2628-7-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2628-8-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/2628-9-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2628-10-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2628-11-0x000007FEF5AF0000-0x000007FEF648D000-memory.dmp

Filesize
9.6MB

Download
memory/2628-12-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2628-13-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2628-14-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2628-15-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download