Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-10-2024 07:42
Static task
static1
Behavioral task
behavioral1
Sample
d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4.js
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4.js
Resource
win10v2004-20240802-en
General
-
Target
d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4.js
-
Size
777KB
-
MD5
bb503cb59416e826e54c606edd10b104
-
SHA1
81a9713534bfb82b5a66dbd6c629df40f1fe79e5
-
SHA256
d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4
-
SHA512
e69e0b367d9cd6639adb9707ec09f57642a7c788f76850fa9d958d1625a4b57ec1d84e7ad43eb07ec5ba054f8d797ebf989336c51ab10a97dbc1ae3a013421e5
-
SSDEEP
6144:HQR2oZA/yOrMb3B2zMCOsUB1q4l3DPZrl7C9PW6BSjlrd3k7HGgjxN+acv/jDinL:wmCq
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 816 wrote to memory of 2644 816 wscript.exe 31 PID 816 wrote to memory of 2644 816 wscript.exe 31 PID 816 wrote to memory of 2644 816 wscript.exe 31
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\d5ae06930fcf5befc19002a652049055822cbfbffa22b93ff0b6e0f2e1ce67a4.js1⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\sijfmrszt.txt"2⤵PID:2644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD52cc7e15396dc275497fcf51f461da38d
SHA16fa0f11b6d9e3812a86ff1d43a86ad34bfc41062
SHA256e14f1c7e11a1f1ddd570d605e4204a694a7370d603c1b1ca157e505f180ccc48
SHA512daf71473c48f9592d33a49ff2f6d7b84e2c3a992f18a29979494cae86623328f0137c6ae9046cf3bbeb75d90d2a030d1fdbf3aca8718ea769429ce1e6e4a931f