Overview
overview
10Static
static
10action/comment.js
windows7-x64
3action/comment.js
windows10-2004-x64
3action/user.js
windows7-x64
3action/user.js
windows10-2004-x64
3go.js
windows7-x64
3go.js
windows10-2004-x64
3inc/class/...per.js
windows7-x64
3inc/class/...per.js
windows10-2004-x64
3inc/class/...ss.ps1
windows7-x64
3inc/class/...ss.ps1
windows10-2004-x64
3inc/class/...ass.js
windows7-x64
3inc/class/...ass.js
windows10-2004-x64
3inc/class/...ass.js
windows7-x64
3inc/class/...ass.js
windows10-2004-x64
3inc/codest...erg.js
windows7-x64
3inc/codest...erg.js
windows10-2004-x64
3inc/codest...ain.js
windows7-x64
3inc/codest...ain.js
windows10-2004-x64
3inc/codest...min.js
windows7-x64
3inc/codest...min.js
windows10-2004-x64
3inc/codest...ins.js
windows7-x64
3inc/codest...ins.js
windows10-2004-x64
3inc/codest...min.js
windows7-x64
3inc/codest...min.js
windows10-2004-x64
3inc/codest...ss.ps1
windows7-x64
3inc/codest...ss.ps1
windows10-2004-x64
3inc/codest...ss.ps1
windows7-x64
3inc/codest...ss.ps1
windows10-2004-x64
3inc/codest...ss.ps1
windows7-x64
3inc/codest...ss.ps1
windows10-2004-x64
3inc/codest...ss.ps1
windows7-x64
3inc/codest...ss.ps1
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 09:17
Behavioral task
behavioral1
Sample
action/comment.js
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
action/comment.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
action/user.js
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
action/user.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
go.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
go.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
inc/class/SignatureHelper.js
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
inc/class/SignatureHelper.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
inc/class/file-class.ps1
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
inc/class/file-class.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
inc/class/qrcode.class.js
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
inc/class/qrcode.class.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
inc/class/sms-class.js
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
inc/class/sms-class.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
inc/codestar-framework/assets/js/gutenberg.js
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
inc/codestar-framework/assets/js/gutenberg.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
inc/codestar-framework/assets/js/main.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
inc/codestar-framework/assets/js/main.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
inc/codestar-framework/assets/js/main.min.js
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
inc/codestar-framework/assets/js/main.min.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
inc/codestar-framework/assets/js/plugins.js
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
inc/codestar-framework/assets/js/plugins.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
inc/codestar-framework/assets/js/plugins.min.js
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
inc/codestar-framework/assets/js/plugins.min.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
inc/codestar-framework/classes/admin-options.class.ps1
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
inc/codestar-framework/classes/admin-options.class.ps1
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
inc/codestar-framework/classes/customize-options.class.ps1
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
inc/codestar-framework/classes/customize-options.class.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
inc/codestar-framework/classes/metabox-options.class.ps1
Resource
win7-20240419-en
Behavioral task
behavioral30
Sample
inc/codestar-framework/classes/metabox-options.class.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
inc/codestar-framework/classes/shortcode-options.class.ps1
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
inc/codestar-framework/classes/shortcode-options.class.ps1
Resource
win10v2004-20240426-en
General
-
Target
inc/codestar-framework/classes/shortcode-options.class.ps1
-
Size
12KB
-
MD5
891a87996b9ee3a4b3cbe5ad210a82ba
-
SHA1
d0d1d3f43f73be59cb2a0bcffb33ce1e3d76e26c
-
SHA256
c9f2e12a5f64433910ee9b3a09959866733610a9e9a47c82e68f2845c53dea80
-
SHA512
5534635cbada84cd90f2b6632dbf77888e391a9e108f09f2141e2be875f1e7eadf5298dcac03ea3a45757f0b2f659e404b9cb8c2d914ff0e85460be6fa037ada
-
SSDEEP
192:q5SKgDmWDe2FVybFE7eaO9aRO0S7h4Sh/VhYtM2/V2Zg2h5wcxSyvxZMYEZwiGD1:qEIE7eaOcR5WiShNhSM2N2J5wC1/
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2052 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2052 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\inc\codestar-framework\classes\shortcode-options.class.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2052-4-0x000007FEF56DE000-0x000007FEF56DF000-memory.dmpFilesize
4KB
-
memory/2052-5-0x000000001B120000-0x000000001B402000-memory.dmpFilesize
2.9MB
-
memory/2052-6-0x0000000002590000-0x0000000002598000-memory.dmpFilesize
32KB
-
memory/2052-7-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmpFilesize
9.6MB
-
memory/2052-8-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmpFilesize
9.6MB
-
memory/2052-9-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmpFilesize
9.6MB
-
memory/2052-10-0x000000000251B000-0x0000000002582000-memory.dmpFilesize
412KB
-
memory/2052-12-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmpFilesize
9.6MB
-
memory/2052-11-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmpFilesize
9.6MB