743569106872154115ba9aa6c4d354ebacb7cb9db052306416f4e3890b994239

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

743569106872154115ba9aa6c4d354ebacb7cb9db052306416f4e3890b994239.js
Size

7KB
MD5

4fcc56b7dbee1342e383030ab4be2e4a
SHA1

63f5f4aa8bc732b9e678e64003f3760ee04c803e
SHA256

743569106872154115ba9aa6c4d354ebacb7cb9db052306416f4e3890b994239
SHA512

07ae0d9c24c3857b058f52cc6719196133e50da699b065e96a27b7e7629a37fede86479884ffddce3b5ba4b38aca95ba4f419fe9eb48cc1effc0a33d5a7606ed
SSDEEP

192:PgDlcwvjBSx2FHIdPNLSxMISUEcwvjszhczS8McInkjHcZSfAIcLcRSTJcwvjG/i:PB47

Score

9^/10

execution

Malware Config

Signatures

Detect jar appended to MSI 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x00070000000186ee-6.dat	jar_in_msi

Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow	pid	Process
4	2440	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exeWScript.exe

description	pid	Process	procid_target
PID 2440 wrote to memory of 2772	2440	wscript.exe	32
PID 2440 wrote to memory of 2772	2440	wscript.exe	32
PID 2440 wrote to memory of 2772	2440	wscript.exe	32
PID 2772 wrote to memory of 2656	2772	WScript.exe	33
PID 2772 wrote to memory of 2656	2772	WScript.exe	33
PID 2772 wrote to memory of 2656	2772	WScript.exe	33

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\743569106872154115ba9aa6c4d354ebacb7cb9db052306416f4e3890b994239.js
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\JLLUMC.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Program Files\Java\jre7\bin\javaw.exe
    "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\VjX.jar"
    3⤵
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JLLUMC.js

Filesize
367KB

MD5
961caa8b91ecbca3ce8601dc4a515e51

SHA1
8480098196ccd298f122bbe9cc463954ddc0f241

SHA256
320ccbaab0c9d5cd7da65b3323b6e3d3cf36c5010d7f80598861150fa809eceb

SHA512
ce591541e0f3ff5d4781dd04c902336ff3b6b416934516c25d11886195d5829bbc13d20e5489811c8995c083b1842f090171e4f6cbf249a64cd1c78f580a72a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\VjX.jar

Filesize
258KB

MD5
e47c15a77ec5efc447b41c23dd4760bc

SHA1
ebd7c32dd6ba13a999e2f05552e6e432d9d49035

SHA256
5f6f4c0f820e97ca6c40d16d25ca1e24010c4f4e3462f4f79c0de8e886528b2a

SHA512
c34daf6940637261e3e596187d9e82c0aecc9f5dc3099126fa8cdc4e8ac596128fc2ce16b829933b802aa0f83e3c916de427f59474636d56ce7bb22f73e0ea35

Download Submit
memory/2656-9-0x00000000025E0000-0x0000000002850000-memory.dmp

Filesize
2.4MB

Download
memory/2656-17-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-24-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-25-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-31-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-35-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-36-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-40-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-42-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-44-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-45-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-48-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-70-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-55-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-75-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-79-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-86-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-89-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-97-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-99-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-142-0x00000000025E0000-0x0000000002850000-memory.dmp

Filesize
2.4MB

Download