55bb2a2ca819696050ebe1c97b5d9c691c2055bf6b8712ff099df6511800f0b6 | Triage

Analysis

max time kernel
90s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
13-01-2021 06:50

Sharing

Report Analysis Logs

General

Target

Invoice.js
Size

881KB
MD5

f51c0415346eefbc435681fce71f36b4
SHA1

2af2663fe36306d8c6fb34f6a29bee985b0fe0d9
SHA256

55bb2a2ca819696050ebe1c97b5d9c691c2055bf6b8712ff099df6511800f0b6
SHA512

2825f013ef137e0f69e55890df45a7209ae54185ac59a6556ff5b1bd04ebef536d39b39256a078089cbfd479a00424faaca4c61ba53950049029db43395d00c7

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

Processes:

wscript.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings wscript.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

3268 regedit.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 3116 wrote to memory of 3268	3116	wscript.exe	regedit.exe
PID 3116 wrote to memory of 3268	3116	wscript.exe	regedit.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Invoice.js
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\regedit.exe
  "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"
  2⤵
  - Runs .reg file with regedit
  PID:3268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3116-2-0x000002BD23A50000-0x000002BD23B51000-memory.dmp

Filesize
1.0MB

Download
memory/3268-3-0x0000000000000000-mapping.dmp

Download