Analysis
- max time kernel
93s - max time network
203s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
14112024_0057_Document-v20-67-12.js
Resource
win7-20241010-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
14112024_0057_Document-v20-67-12.js
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target 14112024_0057_Document-v20-67-12.js
- Size 313KB
- Sample241114-bazqlssdnj
- SHA256 6fadbba0fde3846f28cdf69ad39492bb3db07563590a792a32061049cf7203cb
- MD5 d09bfff0bdbd911a4bc4fcdcb04f8573
- SHA1 9b710c2afe4299d6f2d55e2942170a3c3eb33229
- SHA512 59a5d883211367a2fed101378c23b608ba69d358f3fbf0b0721a60c7c9cf162cedc4c65aac951c39d88ac44069f8166d0a478ab1c249b9a26ee6aa117bfa5267
- SSDEEP 6144:CysSD2NO0m10tUKYb+uy2FBpqaGuwNU3OE4MgFRym/dt:dDVDWuT4XHlt
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 4 4840 msiexec.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 3272 wscript.exe Token: SeIncreaseQuotaPrivilege 3272 wscript.exe Token: SeSecurityPrivilege 4840 msiexec.exe Token: SeCreateTokenPrivilege 3272 wscript.exe Token: SeAssignPrimaryTokenPrivilege 3272 wscript.exe Token: SeLockMemoryPrivilege 3272 wscript.exe Token: SeIncreaseQuotaPrivilege 3272 wscript.exe Token: SeMachineAccountPrivilege 3272 wscript.exe Token: SeTcbPrivilege 3272 wscript.exe Token: SeSecurityPrivilege 3272 wscript.exe Token: SeTakeOwnershipPrivilege 3272 wscript.exe Token: SeLoadDriverPrivilege 3272 wscript.exe Token: SeSystemProfilePrivilege 3272 wscript.exe Token: SeSystemtimePrivilege 3272 wscript.exe Token: SeProfSingleProcessPrivilege 3272 wscript.exe Token: SeIncBasePriorityPrivilege 3272 wscript.exe Token: SeCreatePagefilePrivilege 3272 wscript.exe Token: SeCreatePermanentPrivilege 3272 wscript.exe Token: SeBackupPrivilege 3272 wscript.exe Token: SeRestorePrivilege 3272 wscript.exe Token: SeShutdownPrivilege 3272 wscript.exe Token: SeDebugPrivilege 3272 wscript.exe Token: SeAuditPrivilege 3272 wscript.exe Token: SeSystemEnvironmentPrivilege 3272 wscript.exe Token: SeChangeNotifyPrivilege 3272 wscript.exe Token: SeRemoteShutdownPrivilege 3272 wscript.exe Token: SeUndockPrivilege 3272 wscript.exe Token: SeSyncAgentPrivilege 3272 wscript.exe Token: SeEnableDelegationPrivilege 3272 wscript.exe Token: SeManageVolumePrivilege 3272 wscript.exe Token: SeImpersonatePrivilege 3272 wscript.exe Token: SeCreateGlobalPrivilege 3272 wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\14112024_0057_Document-v20-67-12.js1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:4840