c21cde837f454201d221307723febc220d6ade97b407598a7db07b5b68f0ac15

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
startup.cmd
Size 1KB
Sample240603-nct95ace2y
SHA256 c21cde837f454201d221307723febc220d6ade97b407598a7db07b5b68f0ac15
MD5 431bd656708980356252d3f89f9bc55f
SHA1 7bd82c7c1a6917beb9945f1ac0d1718ca0ee3ca4
SHA512 50637ba23e269053287b962a22fef16296391c3a26d36cf55dfaf86ff3775ca6d4dbec9947a92031aef7b389eda435afafad5fe8ffdde223eb32075d4b0c0842
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 2644	5024	cmd.exe	93
PID 5024 wrote to memory of 2644	5024	cmd.exe	93
PID 5024 wrote to memory of 780	5024	cmd.exe	94
PID 5024 wrote to memory of 780	5024	cmd.exe	94
PID 5024 wrote to memory of 3612	5024	cmd.exe	95
PID 5024 wrote to memory of 3612	5024	cmd.exe	95
PID 5024 wrote to memory of 3764	5024	cmd.exe	96
PID 5024 wrote to memory of 3764	5024	cmd.exe	96
PID 5024 wrote to memory of 2556	5024	cmd.exe	97
PID 5024 wrote to memory of 2556	5024	cmd.exe	97
PID 5024 wrote to memory of 4408	5024	cmd.exe	98
PID 5024 wrote to memory of 4408	5024	cmd.exe	98

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4408	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\startup.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\Downloads\new.js"
  2⤵
  PID:2644
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\Downloads\kam.vbs"
  2⤵
  PID:780
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\Downloads\upload.vbs"
  2⤵
  PID:3612
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\Downloads\las.vbs"
  2⤵
  PID:3764
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\Downloads\time.vbs"
  2⤵
  PID:2556
- C:\Windows\system32\attrib.exe
  attrib +h "C:\Users\Admin\Downloads\Python"
  2⤵
  - Views/modifies file attributes
  PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3240,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:8
1⤵
PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads