da8957456de7d63f5fb37ba57ef08135a8858dd9bc3d0149c0bf7bafa3ab9613

Analysis

max time kernel
151s
max time network
140s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61eee816b2189456d6cdaa92ad067fbb23753dcdb969c7adbbf315d8e59cff87.js
Size

1.2MB
MD5

fb3653b1e95cc1ec2ff33e3534c2e425
SHA1

b2d5623efc547458a619d5904536d23638b4e29d
SHA256

61eee816b2189456d6cdaa92ad067fbb23753dcdb969c7adbbf315d8e59cff87
SHA512

200c9928a9ec0dffdfde5eb75a7129479476040de1fceb3938b02a5c76c5270cb9fc3fd03f0f9c6d066751422d7710d2c0dc8eee7cab35c6ef55a48e4596155c
SSDEEP

6144:MQ7th6IvkW7p8YwVr9k74AVw8OyGhhd16PsKayC+wGUeGer9gACWxaK4KsZMibjN:Xg

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2660	2972	wscript.exe	30
PID 2972 wrote to memory of 2660	2972	wscript.exe	30
PID 2972 wrote to memory of 2660	2972	wscript.exe	30

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\61eee816b2189456d6cdaa92ad067fbb23753dcdb969c7adbbf315d8e59cff87.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\zcrmlauqq.txt"
  2⤵
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\zcrmlauqq.txt

Filesize
164KB

MD5
82c0f8b2ef6a780e0ab1259492a9a192

SHA1
823e401b4948853cada0c01be21e65aaf4164499

SHA256
6ce3a434a861bd56cb32b6102760a5d35fc3e94ee196e15d860ccde41058761d

SHA512
60b86bf4fa78d643fade29de67bc6f356158facf0376240b1a70b044c25f343e7c0c2d1935543ba3ee435fa6bf109f2aaf6fd8d476e1012d76d55cd31ea262a5

Download Submit
memory/2660-4-0x00000000022D0000-0x00000000052D0000-memory.dmp

Filesize
48.0MB

Download
memory/2660-7-0x00000000022D0000-0x00000000052D0000-memory.dmp

Filesize
48.0MB

Download
memory/2660-13-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2660-16-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download