Overview

overview

10

Static

static

10

0b339883d9...899.js

windows7-x64

1

0b339883d9...899.js

windows10-2004-x64

1

Resubmissions

31-03-2023 17:36

230331-v63lxsdd7x 10

21-03-2023 11:45

230321-nwr9waaa97 10

25-02-2023 13:19

230225-qkzwpada7y 10

18-07-2022 10:42

220718-mrnkfsbeh3 10

Analysis

  • max time kernel
    24s
  • max time network
    27s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-03-2023 11:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0b339883d9d76c11e4b22915fa67303fb4302d9855e219db7e803e693e6fb899.js

  • Size

    405KB

  • MD5

    1cbbb572f88a23f55f086b96327fe5e0

  • SHA1

    6d1593368828198dfb5b9eceaab71f49aa535c40

  • SHA256

    0b339883d9d76c11e4b22915fa67303fb4302d9855e219db7e803e693e6fb899

  • SHA512

    dcab6c6025ca9da5301cb6913be35d4285d1ceecc9bd811dfd23727b1b2a14618f3e7a98c18d7a335373c5160c9cb5f62c10f0385387ab7417fc917283981ffd

  • SSDEEP

    3072:WV9Es470kT97kFUxz3mKMACR3R7DyWvEXNemiS0KPMID5whT0bMNj67:dwkwM3zUJtMtwmIj67

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\0b339883d9d76c11e4b22915fa67303fb4302d9855e219db7e803e693e6fb899.js
    1⤵
      PID:1904
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4768

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4768-133-0x0000015989440000-0x0000015989441000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4768-134-0x0000015989440000-0x0000015989441000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4768-135-0x0000015989440000-0x0000015989441000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4768-139-0x0000015989440000-0x0000015989441000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4768-140-0x0000015989440000-0x0000015989441000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4768-141-0x0000015989440000-0x0000015989441000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4768-142-0x0000015989440000-0x0000015989441000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4768-143-0x0000015989440000-0x0000015989441000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4768-144-0x0000015989440000-0x0000015989441000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4768-145-0x0000015989440000-0x0000015989441000-memory.dmp
      Filesize

      4KB

      Download