dea137b7286f22ec0e69d7d85dc14ebacc4951d70d2303bd2b4f201cf4a52334 | Triage

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 23:26 UTC

Sharing

Report Analysis Logs

General

Target

server[php]/cp.js
Size

54KB
MD5

4f092a3993c30c0f152e9ce5e888a8bd
SHA1

b06e0d68cb309a35a6bfa3678295fa086a8e4b52
SHA256

43cb41902d20189de76e9106bc0d486345f448e8754cd7e2946511f4017f1145
SHA512

dc9cdfa27484cc972db0baac098709f8af11dc7c5148a9e7f708fe713e47bb3f3172369ee735d502e670b7311b3b6e0388916744275da398fe05d39262e03be1
SSDEEP

768:V+fxXNQL1zuda57hcFJ0Hum4PN1ctKqYH9dWuKgYzMvpE7fiiMNCZUF+PqtaNqE:V+fhN4XWEHumEctTaWH0iRZm+SgEE

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\server[php]\cp.js
1⤵
PID:3412

Network

DNS

67.31.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.31.126.40.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

67.31.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

67.31.126.40.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads