Analysis

  • max time kernel
    1753s
  • max time network
    1168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-03-2024 10:40

General

  • Target

    Adobe+Photoshop.js

  • Size

    154KB

  • MD5

    ac4b32026ec84d71459a70284caa9088

  • SHA1

    cf518823ec864c51645bae4036ca43249718a7a6

  • SHA256

    a97387f8cb96a95cb068a307c5d7cab05357f58e653be323ba3f3ba0afa76755

  • SHA512

    e70cc5aa5306894e8f61999e7230e99340c893eb4fa7442f02bf884dc49135f53a95ffd9632a4acd22da28c32d77023e71555f7142f7fa7ee7b4b6fcc832a7fc

  • SSDEEP

    3072:EIHm8eorCBcKhZuzoR7qqHb5NRs3NY0/6Pg3X1+Zkewl7Kck:s4cl5NRsdY0/6Pg3X1+Zkewl7Pk

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Adobe+Photoshop.js
    1⤵
      PID:1796
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:1864
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:708

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/708-0-0x000002031E850000-0x000002031E860000-memory.dmp

        Filesize

        64KB

      • memory/708-16-0x000002031E950000-0x000002031E960000-memory.dmp

        Filesize

        64KB

      • memory/708-32-0x0000020326CC0000-0x0000020326CC1000-memory.dmp

        Filesize

        4KB

      • memory/708-34-0x0000020326CF0000-0x0000020326CF1000-memory.dmp

        Filesize

        4KB

      • memory/708-35-0x0000020326CF0000-0x0000020326CF1000-memory.dmp

        Filesize

        4KB

      • memory/708-36-0x0000020326E00000-0x0000020326E01000-memory.dmp

        Filesize

        4KB