Resubmissions
22/05/2025, 18:49
250522-xghassxrw71022/05/2025, 18:46
250522-xepl4axrs61022/05/2025, 14:22
250522-rpjkyavrv41022/05/2025, 14:18
250522-rmk1zshj4x1029/04/2025, 21:41
250429-1j52estms71029/04/2025, 21:41
250429-1js2vstlz224/04/2025, 16:38
250424-t5hdxs1rt322/04/2025, 17:09
250422-vphkeswlx51022/04/2025, 16:35
250422-t3tzya1wav1014/04/2025, 17:40
250414-v89s1swlw910Analysis
- max time kernel
31s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
18/04/2024, 19:05
General
- Target bazaar.2020.02/HEUR-Trojan-Downloader.Script.SLoad.js
- Size 47KB
- Sample240418-xry2ascb73
- SHA256 1460604fef8913322d310b038f6be1c5dbd5b725296a02a4ba13ea4bb3b8329a
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Trojan-Downloader.Script.SLoad.js1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "C:\Users\Admin\Desktop\WaitComplete.dotx"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1932-2-0x00007FFA4C790000-0x00007FFA4C7A0000-memory.dmp
memory/1932-3-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-1-0x00007FFA4C790000-0x00007FFA4C7A0000-memory.dmp
memory/1932-5-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-7-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-9-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-12-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-13-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-11-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-10-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-17-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-19-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-20-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-22-0x00007FFA4A630000-0x00007FFA4A640000-memory.dmp
memory/1932-21-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-18-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-16-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-14-0x00007FFA4A630000-0x00007FFA4A640000-memory.dmp
memory/1932-15-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-8-0x00007FFA4C790000-0x00007FFA4C7A0000-memory.dmp
memory/1932-6-0x00007FFA4C790000-0x00007FFA4C7A0000-memory.dmp
memory/1932-4-0x00007FFA4C790000-0x00007FFA4C7A0000-memory.dmp
memory/1932-35-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp
memory/1932-36-0x00007FFA8C710000-0x00007FFA8C905000-memory.dmp