6845b1b56f96ac2b68de7add4c4037134bd03f1ff735ec86d5a95d552fa4591d

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6845b1b56f96ac2b68de7add4c4037134bd03f1ff735ec86d5a95d552fa4591d.js
Size

27.4MB
MD5

bfe0cd80fbce0d0e8d63f59086624920
SHA1

de1cdfcc2b7e1a1b4f90f9cd9ee1099be4a8b427
SHA256

6845b1b56f96ac2b68de7add4c4037134bd03f1ff735ec86d5a95d552fa4591d
SHA512

f3d8f072b043b1bb7905da81294b3867ddfa8ecf7fc18b4000a24dccea17bb416be5faed7965fa24ab5ba1e4cc512bc658c4c53f067a64259e1e6ff15486d723
SSDEEP

49152:YYRxr8uC0NjaCXEcJgYRxr8uC0NjaCXEcJgYRxr8uC0NjaCXEcJgYRxr8uC0Njau:ic4c4c4ct

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
2688	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	2688	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

taskeng.exewscript.EXEcscript.exe

description	pid	Process	procid_target
PID 2856 wrote to memory of 2872	2856	taskeng.exe	32
PID 2856 wrote to memory of 2872	2856	taskeng.exe	32
PID 2856 wrote to memory of 2872	2856	taskeng.exe	32
PID 2872 wrote to memory of 2676	2872	wscript.EXE	33
PID 2872 wrote to memory of 2676	2872	wscript.EXE	33
PID 2872 wrote to memory of 2676	2872	wscript.EXE	33
PID 2676 wrote to memory of 2688	2676	cscript.exe	35
PID 2676 wrote to memory of 2688	2676	cscript.exe	35
PID 2676 wrote to memory of 2688	2676	cscript.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\6845b1b56f96ac2b68de7add4c4037134bd03f1ff735ec86d5a95d552fa4591d.js
1⤵
PID:2116

C:\Windows\system32\taskeng.exe
taskeng.exe {D8AA6AE0-0B01-4C46-8F97-92721986CF2B} S-1-5-21-3294248377-1418901787-4083263181-1000:FMEDFXFE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\system32\wscript.EXE
  C:\Windows\system32\wscript.EXE CONTIN~1.JS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" "CONTIN~1.JS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Media Center Programs\CONTIN~1.JS

Filesize
39.2MB

MD5
bed186a24ba245fa9a6286fccd331b6c

SHA1
8e5045235d5fb2607c255557c5540d57f4da87dd

SHA256
14ef31c2f5fb361f058bcc166ca6276b66396eab9540b7d85686db075e443489

SHA512
30ce200b32ace4bec3ce481f45218f2d9205fffc11c0f26d0b0981182fa903b518ad47e512f5197d0d2cb5b6f304874c29ddb3e7a4b1eec600f397280426d109

Download Submit
memory/2688-7-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2688-8-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download