ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb

Resubmissions

11-09-2024 09:28

240911-lfggbstglb 3

11-09-2024 09:25

11-09-2024 09:24

11-09-2024 09:23

11-09-2024 09:21

11-09-2024 09:18

Analysis

max time kernel
0s
max time network
128s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
11-09-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file01.js
Size

1B
MD5

0cc175b9c0f1b6a831c399e269772661
SHA1

86f7e437faa5a7fce15d1ddcb9eaeaea377667b8
SHA256

ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb
SHA512

1f40fc92da241694750979ee6cf582f2d5d7d28e18335de05abc54d0560e0f5302860c652bf08d560252aa5e74210546f369fbbbce8c12cfc7957b2652fe9a75

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs 1 IoCs
Execution via JavaScript.
execution

JavaScript
T1059.007

Processes:

node

pid process

1562 node

pid	process
1562	node

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

Processes:

node

description	ioc	process
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/memory.max	node
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/memory.high	node

Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
discovery

Processes:

node

description ioc process

File opened for reading /proc/self/cgroup node
File opened for reading /proc/meminfo node
File opened for reading /proc/self/maps node

description	ioc	process
File opened for reading	/proc/self/cgroup	node
File opened for reading	/proc/meminfo	node
File opened for reading	/proc/self/maps	node

/usr/bin/node
node /tmp/file01.js
1⤵
- Command and Scripting Interpreter: JavaScript
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1562

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads