Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22-09-2024 01:32

General

  • Target

    c6fee7fb70025c071b147b62a8f12eff3fc9f2c05e192e423ca4164de6b02a46.js

  • Size

    735KB

  • MD5

    cdc82b3a33f628b81a778ab0113cbc07

  • SHA1

    64fb545477164d33fec94483ad440d13ee69914b

  • SHA256

    c6fee7fb70025c071b147b62a8f12eff3fc9f2c05e192e423ca4164de6b02a46

  • SHA512

    80ffc5356fae94e88831c10969a5d582f6b416de25f071ec9b6a2fa220ccd1349267978a25c5ccbac16e4faca00fa285c860e2c07a8fc8e21357715e9f53b856

  • SSDEEP

    6144:HQgVAE6B1K5/5lTBO60rIqscTHl2xmQ8xt8geFwFx7YwnTLK8N5ocR3xJhi9Mw9B:wDK

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\c6fee7fb70025c071b147b62a8f12eff3fc9f2c05e192e423ca4164de6b02a46.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\anmdkwtxwh.txt"
      2⤵
        PID:2396

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\anmdkwtxwh.txt

      Filesize

      92KB

      MD5

      2cc7e15396dc275497fcf51f461da38d

      SHA1

      6fa0f11b6d9e3812a86ff1d43a86ad34bfc41062

      SHA256

      e14f1c7e11a1f1ddd570d605e4204a694a7370d603c1b1ca157e505f180ccc48

      SHA512

      daf71473c48f9592d33a49ff2f6d7b84e2c3a992f18a29979494cae86623328f0137c6ae9046cf3bbeb75d90d2a030d1fdbf3aca8718ea769429ce1e6e4a931f

    • memory/2396-4-0x00000000025F0000-0x0000000002860000-memory.dmp

      Filesize

      2.4MB

    • memory/2396-12-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-19-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-26-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-32-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-37-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-38-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-39-0x00000000025F0000-0x0000000002860000-memory.dmp

      Filesize

      2.4MB

    • memory/2396-41-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-43-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-44-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-51-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-56-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-76-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2396-86-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB