f3654a2f17cafc873e5444dfb2225890e367be0fe1671c0b3b55b59a619e4e70 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7v20201028
submitted
13-01-2021 06:51

Sharing

Report Analysis Logs

General

Target

PurchaseOrder2021.js
Size

27KB
MD5

fa8bce6d2a200116afe9f7f2ebd8ba42
SHA1

45abfb24af5f44d42a94ae145c126800fc84e48f
SHA256

f3654a2f17cafc873e5444dfb2225890e367be0fe1671c0b3b55b59a619e4e70
SHA512

fa0e29f2d4fb4509d2362dcb9b832c4eabe760a3f875d8b253a6636c7e2dea278f0ef9ec3654e0e452c90b49b5956b2ea6991af198220491cd5ea4965d753657

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 25 IoCs

Processes:

wscript.exe

flow	pid	process
7	1924	wscript.exe
9	1924	wscript.exe
10	1924	wscript.exe
11	1924	wscript.exe
12	1924	wscript.exe
13	1924	wscript.exe
14	1924	wscript.exe
15	1924	wscript.exe
16	1924	wscript.exe
17	1924	wscript.exe
18	1924	wscript.exe
19	1924	wscript.exe
20	1924	wscript.exe
21	1924	wscript.exe
22	1924	wscript.exe
24	1924	wscript.exe
25	1924	wscript.exe
26	1924	wscript.exe
27	1924	wscript.exe
28	1924	wscript.exe
29	1924	wscript.exe
31	1924	wscript.exe
32	1924	wscript.exe
33	1924	wscript.exe
34	1924	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PurchaseOrder2021.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PurchaseOrder2021.js	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder2021.js
1⤵
- Blocklisted process makes network request
- Drops startup file
PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-2-0x000007FEF6680000-0x000007FEF68FA000-memory.dmp

Filesize
2.5MB

Download