Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    30-09-2024 08:26

General

  • Target

    Request For Quotation.js

  • Size

    777KB

  • MD5

    bb503cb59416e826e54c606edd10b104

  • SHA1

    81a9713534bfb82b5a66dbd6c629df40f1fe79e5

  • SHA256

    d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4

  • SHA512

    e69e0b367d9cd6639adb9707ec09f57642a7c788f76850fa9d958d1625a4b57ec1d84e7ad43eb07ec5ba054f8d797ebf989336c51ab10a97dbc1ae3a013421e5

  • SSDEEP

    6144:HQR2oZA/yOrMb3B2zMCOsUB1q4l3DPZrl7C9PW6BSjlrd3k7HGgjxN+acv/jDinL:wmCq

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Request For Quotation.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\teynadqgxb.txt"
      2⤵
        PID:2764

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\teynadqgxb.txt

      Filesize

      92KB

      MD5

      2cc7e15396dc275497fcf51f461da38d

      SHA1

      6fa0f11b6d9e3812a86ff1d43a86ad34bfc41062

      SHA256

      e14f1c7e11a1f1ddd570d605e4204a694a7370d603c1b1ca157e505f180ccc48

      SHA512

      daf71473c48f9592d33a49ff2f6d7b84e2c3a992f18a29979494cae86623328f0137c6ae9046cf3bbeb75d90d2a030d1fdbf3aca8718ea769429ce1e6e4a931f

    • memory/2764-4-0x00000000023F0000-0x0000000002660000-memory.dmp

      Filesize

      2.4MB

    • memory/2764-12-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2764-19-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2764-20-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2764-29-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2764-34-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2764-38-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2764-39-0x00000000023F0000-0x0000000002660000-memory.dmp

      Filesize

      2.4MB

    • memory/2764-41-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2764-43-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2764-48-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2764-49-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2764-55-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2764-76-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB