427e4dcb36206392d10846d4aa4e37ec0c724d2b5c26c662b3670b120bdf84c3

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 09:39

Target

DOC934798848.js
Size

238KB
MD5

208ac4eb6c75aced85071562b1bc079d
SHA1

0a3bb6f310317d31bad26a0076c5e7313699739b
SHA256

427e4dcb36206392d10846d4aa4e37ec0c724d2b5c26c662b3670b120bdf84c3
SHA512

1f2d13791bbc1e58f42eee63e6e5708b333d476d0f3ea39c185a99a7f11079477c80ddbef4304a27a4b62114579b5443d0d698a689929ccea3e0b27bee3d9b13
SSDEEP

6144:eQrh+XeVWsUDMmQPiXmvnuKFESB51tsr3wtNX5ihm:19xWsUDaESBBsr3uXl

Score

3^/10

execution

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 2388 wrote to memory of 2468	2388	wscript.exe	javaw.exe
PID 2388 wrote to memory of 2468	2388	wscript.exe	javaw.exe
PID 2388 wrote to memory of 2468	2388	wscript.exe	javaw.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\DOC934798848.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\xviookt.txt"
  2⤵
  PID:2468

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\xviookt.txt

Filesize
109KB

MD5
7a5c4c8206af87ef76588eaa1fab0060

SHA1
30a4b99d4a65cf9bd7997fe2365bf677b7849a54

SHA256
e70bb96d50cb6319c4da5972c986dd4732ab6c4c78af96687454ffdb95b56b4b

SHA512
352b5dc4081928a713ea79c761752c0e2ef5f4cdfc5e2426f9e2643ee0a490415d27d29f92373ba8e463b773f3e2b0e5236336673ce0b27f68bed3b3c3a3a7fe

Download Submit
memory/2468-4-0x0000000002040000-0x00000000022B0000-memory.dmp

Filesize
2.4MB

Download
memory/2468-12-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2468-15-0x0000000002040000-0x00000000022B0000-memory.dmp

Filesize
2.4MB

Download