Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-09-2024 14:06

General

  • Target

    Tax Returns of R38,765.js

  • Size

    208KB

  • MD5

    07a0d070e8d38905650da46f677a183f

  • SHA1

    619c168ccb0a8ba75ddf6f09de13d1014c263fec

  • SHA256

    2e2cd055d7e6d78706cd68ebe604e0be01e7df2df2d12a2d32ca457b5c817475

  • SHA512

    7878310e5674a54aac723b586497588be058bb140193ba19edc2b44800a16208ea83a12a788c84b6b46f16fd789e581114f07904f36aa7faef24099b12c4820f

  • SSDEEP

    6144:HQKcv+xEZJlC3uPVTMvXdQrjigndzr8cMhuky:w1JEeZMvCrj7Z/

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Tax Returns of R38,765.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\yfpymuyksv.txt"
      2⤵
        PID:2968

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\yfpymuyksv.txt

      Filesize

      92KB

      MD5

      2cc7e15396dc275497fcf51f461da38d

      SHA1

      6fa0f11b6d9e3812a86ff1d43a86ad34bfc41062

      SHA256

      e14f1c7e11a1f1ddd570d605e4204a694a7370d603c1b1ca157e505f180ccc48

      SHA512

      daf71473c48f9592d33a49ff2f6d7b84e2c3a992f18a29979494cae86623328f0137c6ae9046cf3bbeb75d90d2a030d1fdbf3aca8718ea769429ce1e6e4a931f

    • memory/2968-4-0x00000000026A0000-0x0000000002910000-memory.dmp

      Filesize

      2.4MB

    • memory/2968-12-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2968-19-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2968-26-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2968-30-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2968-36-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2968-39-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2968-40-0x00000000026A0000-0x0000000002910000-memory.dmp

      Filesize

      2.4MB

    • memory/2968-44-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2968-45-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2968-52-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2968-75-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2968-84-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2968-87-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB