Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-10-2024 01:38

General

  • Target

    48e280510d763ea0508f85658e5a5fdf4fb9a5b5e3de47d9fc271210a2e9f6f3.js

  • Size

    853KB

  • MD5

    7830034fcf7339f1d60f197b5298fde0

  • SHA1

    5b46b120da09408ac5365a41d2d1d592ee16354e

  • SHA256

    48e280510d763ea0508f85658e5a5fdf4fb9a5b5e3de47d9fc271210a2e9f6f3

  • SHA512

    4ff8ac75039d6fbf0060f73b18d74d37ad4f8b47b490dc869b26f9671c593dcf65eab52e6e0f0ef71f05189648bc0d74aac78b667553e0fce0f2e20e476d8265

  • SSDEEP

    6144:KQXRiLVR+ZAFgfFIxviPCxeocRmAmuJp36clx+SzqAXyLCXiXh9VFIoqjKh633zq:Zo

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\48e280510d763ea0508f85658e5a5fdf4fb9a5b5e3de47d9fc271210a2e9f6f3.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\baavkncpcc.txt"
      2⤵
        PID:2004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\baavkncpcc.txt

      Filesize

      92KB

      MD5

      2cc7e15396dc275497fcf51f461da38d

      SHA1

      6fa0f11b6d9e3812a86ff1d43a86ad34bfc41062

      SHA256

      e14f1c7e11a1f1ddd570d605e4204a694a7370d603c1b1ca157e505f180ccc48

      SHA512

      daf71473c48f9592d33a49ff2f6d7b84e2c3a992f18a29979494cae86623328f0137c6ae9046cf3bbeb75d90d2a030d1fdbf3aca8718ea769429ce1e6e4a931f

    • memory/2004-4-0x00000000024D0000-0x0000000002740000-memory.dmp

      Filesize

      2.4MB

    • memory/2004-12-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2004-19-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2004-29-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2004-34-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2004-36-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2004-37-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2004-38-0x00000000024D0000-0x0000000002740000-memory.dmp

      Filesize

      2.4MB

    • memory/2004-42-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/2004-46-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB