e95b00e2410e59526ac95bcd640eb1a8a2e9da7489d9db146d7bc2fe8742b3cf

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 08:46

Target

e95b00e2410e59526ac95bcd640eb1a8a2e9da7489d9db146d7bc2fe8742b3cf.js
Size

240KB
MD5

ee561cb65c1c091022c0fc74326ed6e1
SHA1

0c7451bdeaf769da591e070537472d2514f138eb
SHA256

e95b00e2410e59526ac95bcd640eb1a8a2e9da7489d9db146d7bc2fe8742b3cf
SHA512

d349da1e356830d3109262f683f0d7b27da98ad56bd07ad43849fc712cd8c1985e23b5639a07fbe9717a70736844cd8df20b7411985ebbb43f397c1700585d38
SSDEEP

6144:eQLk79lpKjq/aJYrMfy7wJfVm642LbIXSBFfAfx1:1LwAz6kFueIXCIfP

Score

3^/10

execution

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 2368 wrote to memory of 1984	2368	wscript.exe	javaw.exe
PID 2368 wrote to memory of 1984	2368	wscript.exe	javaw.exe
PID 2368 wrote to memory of 1984	2368	wscript.exe	javaw.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\e95b00e2410e59526ac95bcd640eb1a8a2e9da7489d9db146d7bc2fe8742b3cf.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\kvqvwoylm.txt"
  2⤵
  PID:1984

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\kvqvwoylm.txt

Filesize
109KB

MD5
7a5c4c8206af87ef76588eaa1fab0060

SHA1
30a4b99d4a65cf9bd7997fe2365bf677b7849a54

SHA256
e70bb96d50cb6319c4da5972c986dd4732ab6c4c78af96687454ffdb95b56b4b

SHA512
352b5dc4081928a713ea79c761752c0e2ef5f4cdfc5e2426f9e2643ee0a490415d27d29f92373ba8e463b773f3e2b0e5236336673ce0b27f68bed3b3c3a3a7fe

Download Submit
memory/1984-4-0x0000000002440000-0x00000000026B0000-memory.dmp

Filesize
2.4MB

Download
memory/1984-12-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1984-15-0x0000000002440000-0x00000000026B0000-memory.dmp

Filesize
2.4MB

Download