Analysis

  • max time kernel
    146s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01-10-2024 01:46

General

  • Target

    d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4.js

  • Size

    777KB

  • MD5

    bb503cb59416e826e54c606edd10b104

  • SHA1

    81a9713534bfb82b5a66dbd6c629df40f1fe79e5

  • SHA256

    d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4

  • SHA512

    e69e0b367d9cd6639adb9707ec09f57642a7c788f76850fa9d958d1625a4b57ec1d84e7ad43eb07ec5ba054f8d797ebf989336c51ab10a97dbc1ae3a013421e5

  • SSDEEP

    6144:HQR2oZA/yOrMb3B2zMCOsUB1q4l3DPZrl7C9PW6BSjlrd3k7HGgjxN+acv/jDinL:wmCq

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\agevgbx.txt"
      2⤵
        PID:1884

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\agevgbx.txt

      Filesize

      92KB

      MD5

      2cc7e15396dc275497fcf51f461da38d

      SHA1

      6fa0f11b6d9e3812a86ff1d43a86ad34bfc41062

      SHA256

      e14f1c7e11a1f1ddd570d605e4204a694a7370d603c1b1ca157e505f180ccc48

      SHA512

      daf71473c48f9592d33a49ff2f6d7b84e2c3a992f18a29979494cae86623328f0137c6ae9046cf3bbeb75d90d2a030d1fdbf3aca8718ea769429ce1e6e4a931f

    • memory/1884-4-0x0000000002560000-0x00000000027D0000-memory.dmp

      Filesize

      2.4MB

    • memory/1884-12-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-19-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-26-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-32-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-38-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-39-0x0000000002560000-0x00000000027D0000-memory.dmp

      Filesize

      2.4MB

    • memory/1884-43-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-44-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-45-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-51-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-74-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-76-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-80-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-82-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-84-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/1884-86-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB