a6fc2e334541ffe6b0aba132b098a1b05c96dc064a00918575726c0233e7ea57 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7v20201028
submitted
13-01-2021 06:51

Sharing

Report Analysis Logs

General

Target

POrder.js
Size

28KB
MD5

be51f0be7f09810371f295b5107e761a
SHA1

c682dc23529552a71bf8f170204a1b44d25246e7
SHA256

a6fc2e334541ffe6b0aba132b098a1b05c96dc064a00918575726c0233e7ea57
SHA512

da69f1c7703f82a33c7d7babed569634ec72428a63df140c3ab0abeb42e7f7597167966c41a18ba235c7a4fb5f6624f4fbd6a135532e3eca162932ed712eb370

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 23 IoCs

Processes:

wscript.exe

flow	pid	process
6	848	wscript.exe
8	848	wscript.exe
9	848	wscript.exe
10	848	wscript.exe
11	848	wscript.exe
12	848	wscript.exe
13	848	wscript.exe
14	848	wscript.exe
15	848	wscript.exe
16	848	wscript.exe
17	848	wscript.exe
18	848	wscript.exe
19	848	wscript.exe
20	848	wscript.exe
21	848	wscript.exe
22	848	wscript.exe
23	848	wscript.exe
24	848	wscript.exe
25	848	wscript.exe
26	848	wscript.exe
27	848	wscript.exe
29	848	wscript.exe
30	848	wscript.exe

Drops startup file 1 IoCs

Processes:

wscript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\POrder.js wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\POrder.js
1⤵
- Blocklisted process makes network request
- Drops startup file
PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-2-0x000007FEF6580000-0x000007FEF67FA000-memory.dmp

Filesize
2.5MB

Download