Analysis
-
max time kernel
0s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31-12-2023 11:22
General
-
Target
34257f43cd09bb9f9aa171b8d5d40d15.js
-
Size
53KB
-
MD5
34257f43cd09bb9f9aa171b8d5d40d15
-
SHA1
2205fc3296c2fa97706700c4e6d6f7ef1f185892
-
SHA256
8b2a8b2e8d7b89e72c2fbdbb79596f9d4dcc0a4304c566ee26bd5b966a099568
-
SHA512
b16feb70bddc57e556be7db50242a50a600e4775d6a64af64be2d25c055e2e7d0bf292b9c318ff1ddfd9d994995b2f27e47e22b216e864e39d579560ba8c9b08
-
SSDEEP
768:H7XWEtO8a1ZLbWVfgiZb1pW0GpswDx79qs8dfcdaXKzC5Oo+eVO5p+JD1z:LW9v1lWdjQDx79qtdco+eVOnu
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\34257f43cd09bb9f9aa171b8d5d40d15.js1⤵
-
C:\Users\Admin\AppData\Roaming\New-Client.exe"C:\Users\Admin\AppData\Roaming\New-Client.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\player.exe'"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\player.exe"C:\Users\Admin\AppData\Roaming\player.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB