563447dc5e79ab2311f2d59498f791d6515cc97c2cecc47c6cec51f9089ed0b9

Resubmissions

21-11-2024 19:00

241121-xn2ysavmft 7

21-11-2024 18:39

241121-xa5gravles 7

Analysis

max time kernel
96s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app/js/block_inputs.js
Size

789B
MD5

b5b52c92b90f4283a761cb8a40860c75
SHA1

7212e7e566795017e179e7b9c9bf223b0cdb9ec2
SHA256

f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
SHA512

16ad53ede5424ca1384e3caea25225589e9eec9e80e2d845948802db90fad222f709a7b651cd7601a34ba67a0627433f25764638fd542cbd4612871308e7b353

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

944 taskkill.exe
4708 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 944 taskkill.exe

pid	process
944	taskkill.exe
4708	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	944	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1732 wrote to memory of 944	1732	cmd.exe	taskkill.exe
PID 1732 wrote to memory of 944	1732	cmd.exe	taskkill.exe
PID 1732 wrote to memory of 4708	1732	cmd.exe	taskkill.exe
PID 1732 wrote to memory of 4708	1732	cmd.exe	taskkill.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\js\block_inputs.js
1⤵
PID:4068

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\taskkill.exe
  taskkill /f /im /svchost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- C:\Windows\system32\taskkill.exe
  taskkill /f /m svchost.exe
  2⤵
  - Kills process with taskkill
  PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads