435a0c48dae88e7546b0181a23f50fbbe774c734cd3953d74fc89913cea66af3

Resubmissions

26/03/2024, 21:50

26/03/2024, 21:32

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 21:50

Target

146d1d8470f6d1642cb6906a2e584696cbf81b681b6422866ef33aa52b8e2f04.js
Size

39.8MB
MD5

7c8debc2ba8f7442c9c3d06387698bfe
SHA1

17ce35b93131aa3797dbd6b91a53b946fbb5792c
SHA256

146d1d8470f6d1642cb6906a2e584696cbf81b681b6422866ef33aa52b8e2f04
SHA512

5551d93e4198fb2b30c1cb6cb40e6840dd0abd78e2b749d25b3e947aba0a2da75dbea4e05bf9799f8b697c1a7e54cad28ab8fa7859a9cbcf3f249d78bf0a1c61
SSDEEP

6144:2ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff4:n

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2444	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2444	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2628	2288	wscript.exe	28
PID 2288 wrote to memory of 2628	2288	wscript.exe	28
PID 2288 wrote to memory of 2628	2288	wscript.exe	28
PID 2628 wrote to memory of 2444	2628	cscript.exe	30
PID 2628 wrote to memory of 2444	2628	cscript.exe	30
PID 2628 wrote to memory of 2444	2628	cscript.exe	30

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\146d1d8470f6d1642cb6906a2e584696cbf81b681b6422866ef33aa52b8e2f04.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" "146d1d8470f6d1642cb6906a2e584696cbf81b681b6422866ef33aa52b8e2f04.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2444

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2444-4-0x000000001B1B0000-0x000000001B492000-memory.dmp

Filesize
2.9MB

Download
memory/2444-5-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/2444-6-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

Filesize
9.6MB

Download
memory/2444-7-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2444-8-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

Filesize
9.6MB

Download
memory/2444-9-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2444-10-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2444-11-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2444-12-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

Filesize
9.6MB

Download
memory/2444-13-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2444-14-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2444-15-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2444-16-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download