Overview

overview

8

Static

static

1

3d3b93e744...076.js

windows7-x64

8

3d3b93e744...076.js

windows10-2004-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 01:11 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3d3b93e744a9fc154a70b6a6b709be2806598abb2b00db8e51faa55f961f3076.js

  • Size

    262KB

  • MD5

    61003ace63f39ed1cc39a22cb924e6b1

  • SHA1

    914548e77023a990b0e79e1cea9ce25991e8116e

  • SHA256

    3d3b93e744a9fc154a70b6a6b709be2806598abb2b00db8e51faa55f961f3076

  • SHA512

    e9d25955a7a9700b996dc435e23505ddb772290bf6370a0ccd122a34fc6c21c935b6a4dfc60fd2d2d00e74e6edb0f6f49d9df960a2ac3b7155a98d908560ba53

  • SSDEEP

    96:GM969Xx6VdE6ruU6S+4SWp9uS+V6fXuSEFYcnhVM3/DyBCODI99PRdN1QNLq9Iu/:gWGcucNHw1c5UEWzC423S68XC

Score
8/10
executionpersistence

Malware Config

Signatures

  • Blocklisted process makes network request 20 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\3d3b93e744a9fc154a70b6a6b709be2806598abb2b00db8e51faa55f961f3076.js
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    • Adds Run key to start application
    PID:108

Network

  • flag-us
    DNS
    chongmei33.publicvm.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    chongmei33.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    chongmei33.publicvm.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    chongmei33.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    chongmei33.publicvm.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    chongmei33.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    chongmei33.publicvm.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    chongmei33.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    chongmei33.publicvm.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    chongmei33.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    chongmei33.publicvm.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    chongmei33.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    chongmei33.publicvm.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    chongmei33.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    chongmei33.publicvm.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    chongmei33.publicvm.com
    IN A
    Response
  • flag-us
    DNS
    chongmei33.publicvm.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    chongmei33.publicvm.com
    IN A
    Response
    chongmei33.publicvm.com
    IN A
    46.246.6.12
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 46.246.6.12:7045
    chongmei33.publicvm.com
    wscript.exe
    152 B
     120 B
     3
    3
  • 8.8.8.8:53
    chongmei33.publicvm.com
    dns
    wscript.exe
    276 B
     276 B
     4
    4

    DNS Request

    chongmei33.publicvm.com

    DNS Request

    chongmei33.publicvm.com

    DNS Request

    chongmei33.publicvm.com

    DNS Request

    chongmei33.publicvm.com

  • 8.8.8.8:53
    chongmei33.publicvm.com
    dns
    wscript.exe
    276 B
     276 B
     4
    4

    DNS Request

    chongmei33.publicvm.com

    DNS Request

    chongmei33.publicvm.com

    DNS Request

    chongmei33.publicvm.com

    DNS Request

    chongmei33.publicvm.com

  • 8.8.8.8:53
    chongmei33.publicvm.com
    dns
    wscript.exe
    69 B
     85 B
     1
    1

    DNS Request

    chongmei33.publicvm.com

    DNS Response

    46.246.6.12

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3d3b93e744a9fc154a70b6a6b709be2806598abb2b00db8e51faa55f961f3076.js
    Filesize

    262KB

    MD5

    61003ace63f39ed1cc39a22cb924e6b1

    SHA1

    914548e77023a990b0e79e1cea9ce25991e8116e

    SHA256

    3d3b93e744a9fc154a70b6a6b709be2806598abb2b00db8e51faa55f961f3076

    SHA512

    e9d25955a7a9700b996dc435e23505ddb772290bf6370a0ccd122a34fc6c21c935b6a4dfc60fd2d2d00e74e6edb0f6f49d9df960a2ac3b7155a98d908560ba53

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.