919720afc5ba1bec972576f71fcde38b9e7597425a34ba7ffb8ba38147485e72 | Triage

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2023, 04:18

Sharing

Report Analysis Logs

General

Target

ajax.js
Size

346B
MD5

ab2368042f88d56a4e8eb7ef0885d52d
SHA1

e55117f4b00ac9eb0c34f931a2445b83529ad686
SHA256

02b53a0b873d484d796cd24cc6b0c12704b01720dd08682068c54e5cb06a0ac3
SHA512

11f547898476e25479986dc16ec2c09f7c8732d73e521920028ef8b71bdbea691ae759d03ad0bc383d03c33e378662751bc0a69ae6f366ee9bb4a6ae8c5cf25a

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{2F290EF8-5463-4E79-A470-6419B57F9C44}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4C8A7215-8E52-4BB9-AA9E-64957FC9A73F}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D1217889-4DE1-4C3F-B5A6-4D59A3DC5DE6}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E67D3DCD-711B-4F38-A040-3351023956A2}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4474BAB7-5690-4F82-9685-EED65B5B209D}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0288182E-5A66-43CC-A63F-2F5982BA79AD}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F2354EA9-34B2-4EA1-8CFC-D2F2B9786174}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{67E641B2-672A-44A3-8C20-6DCB2747702E}.catalogItem	svchost.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ajax.js
1⤵
PID:2028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:4376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads