550494982ec4cdbba11cbaf5a44ea3a4a7ff710f78e7e8c953f33bbdc204d091

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

550494982ec4cdbba11cbaf5a44ea3a4a7ff710f78e7e8c953f33bbdc204d091.js
Size

114KB
MD5

676083473f1cbd772fbb9560aaa6d78f
SHA1

6996d14b646f30f2db921a14f7cb022075b66b7a
SHA256

550494982ec4cdbba11cbaf5a44ea3a4a7ff710f78e7e8c953f33bbdc204d091
SHA512

c2d9ad8ceea7a3f2a905a3e80b867fc1cc6e49407540f7e607bd021633ff9063b0b553672d098d4a30d715237cafb744ed4dd232ff0feef879be706c9c00e0a8
SSDEEP

3072:7zbLWB/sJtttttttttttttttttttattttttttttttttttttttn0ZlDrOm1tttttW:OB/m7iT

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2340	x.exe

Loads dropped DLL 5 IoCs

pid	Process
2688	WerFault.exe
2688	WerFault.exe
2688	WerFault.exe
2688	WerFault.exe
2688	WerFault.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	2340	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	x.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2340	2324	wscript.exe	31
PID 2324 wrote to memory of 2340	2324	wscript.exe	31
PID 2324 wrote to memory of 2340	2324	wscript.exe	31
PID 2324 wrote to memory of 2340	2324	wscript.exe	31
PID 2340 wrote to memory of 2688	2340	x.exe	32
PID 2340 wrote to memory of 2688	2340	x.exe	32
PID 2340 wrote to memory of 2688	2340	x.exe	32
PID 2340 wrote to memory of 2688	2340	x.exe	32

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\550494982ec4cdbba11cbaf5a44ea3a4a7ff710f78e7e8c953f33bbdc204d091.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 1252
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
60KB

MD5
3beeb3726e4363c5bd33cab9865a799a

SHA1
bb0d6483030e5557145cd38c3ea71129b3d201a0

SHA256
74837dc749f77e6fe41b9d41278a19b3a1990a31731c87e7327528d27e0a2fac

SHA512
d5658c54f916934ddaadd794fb21a7c2f8abd6187cb7a9fc2733e69a6ccda5c48b2fa9c1d33fbb3066c981f882e3c42eab188cbffc27c94bafaada7777cd42f2

Download Submit
memory/2340-6-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

Filesize
4KB

Download
memory/2340-7-0x0000000001240000-0x0000000001254000-memory.dmp

Filesize
80KB

Download
memory/2340-8-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/2340-14-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

Filesize
4KB

Download
memory/2340-15-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download