cd4caace5e85b095654b499c34414a1d839ff30bf910993c3ebcdc1fbd9ff2bf

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 02:44

Target

cd4caace5e85b095654b499c34414a1d839ff30bf910993c3ebcdc1fbd9ff2bf.js
Size

80KB
MD5

5eed57a36b459c29a10dbc8458493a26
SHA1

4be4299dc346dc3499adb4b01edd09b339d858a4
SHA256

cd4caace5e85b095654b499c34414a1d839ff30bf910993c3ebcdc1fbd9ff2bf
SHA512

59192b7d17198bf257fe8de35ce9523f61a7eb8495647a784f6b386dfbf60642c5109bc37bccb580e71047d556a5ebf86e7943efe57d9f06c4435e57846732d2
SSDEEP

768:rZQ0foU+Ui73GNNUZZQSYsVxU4Ua4UYdIMfVkArv6rAHcVxEBxVNoYdDBHBqabPg:oC1l2unjA06

Score

7^/10

execution

Deletes itself 1 IoCs

Processes:

wscript.exe

pid process

2524 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2412 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2412 powershell.exe

pid	process
2524	wscript.exe

pid	process
2412	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2412	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 2524 wrote to memory of 2412	2524	wscript.exe	powershell.exe
PID 2524 wrote to memory of 2412	2524	wscript.exe	powershell.exe
PID 2524 wrote to memory of 2412	2524	wscript.exe	powershell.exe

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2412-4-0x000007FEF5C9E000-0x000007FEF5C9F000-memory.dmp

Filesize
4KB

Download
memory/2412-5-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2412-6-0x000007FEF59E0000-0x000007FEF637D000-memory.dmp

Filesize
9.6MB

Download
memory/2412-7-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2412-8-0x000007FEF59E0000-0x000007FEF637D000-memory.dmp

Filesize
9.6MB

Download
memory/2412-9-0x000007FEF59E0000-0x000007FEF637D000-memory.dmp

Filesize
9.6MB

Download
memory/2412-10-0x000007FEF59E0000-0x000007FEF637D000-memory.dmp

Filesize
9.6MB

Download
memory/2412-11-0x000007FEF59E0000-0x000007FEF637D000-memory.dmp

Filesize
9.6MB

Download
memory/2412-12-0x000007FEF59E0000-0x000007FEF637D000-memory.dmp

Filesize
9.6MB

Download