Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 08:28
Static task
static1
Behavioral task
behavioral1
Sample
Proof Of Payment.js
Resource
win7-20240903-en
General
-
Target
Proof Of Payment.js
-
Size
201KB
-
MD5
2878fe1c714e00753242baaa5b963431
-
SHA1
1c2ba4d2720e5b6060921bd9c393723778d06825
-
SHA256
7e97d5e7aa2412d71a076154766ddd78057bff909fc9a3469a38893459735642
-
SHA512
c9181487b77bf0182314f8e112b88a1b485616e749dd3fbb4f720e43dc572735f308b5929ea0c2139701a675c613a76b3a38cdabad40d0620a564cba17d483c0
-
SSDEEP
6144:HQ9wzMWq0XEeUV34SHJnk0qktWe4gsossPHx62ueG3wgxfpnamojieE37kPoaGdE:wjc7J0B8O
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2320 2480 wscript.exe 31 PID 2480 wrote to memory of 2320 2480 wscript.exe 31 PID 2480 wrote to memory of 2320 2480 wscript.exe 31
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Proof Of Payment.js"1⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\oaimldlcab.txt"2⤵PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD52cc7e15396dc275497fcf51f461da38d
SHA16fa0f11b6d9e3812a86ff1d43a86ad34bfc41062
SHA256e14f1c7e11a1f1ddd570d605e4204a694a7370d603c1b1ca157e505f180ccc48
SHA512daf71473c48f9592d33a49ff2f6d7b84e2c3a992f18a29979494cae86623328f0137c6ae9046cf3bbeb75d90d2a030d1fdbf3aca8718ea769429ce1e6e4a931f