cbbe0024954f1de4b97faad7f7bff8bddce3aa4c71d190dfb6819b58d365a144 | Triage

Analysis

max time kernel
149s
max time network
157s
platform
windows7_x64
resource
win7v20201028
submitted
13-01-2021 06:51

Sharing

Report Analysis Logs

General

Target

Order2021.js
Size

28KB
MD5

62247f049cfae09bceae111f086458fd
SHA1

3237692834c839beccfa746dba2fc5024d874616
SHA256

cbbe0024954f1de4b97faad7f7bff8bddce3aa4c71d190dfb6819b58d365a144
SHA512

3cd93a13099a1d599081f88bb90a5374f640fcb640b05a3ccea55a9eb8b419f089ad01de3f282da4887fcdf1aaec7ea4bf27eac7a33db9a06f99bf6cd44cf4f7

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 28 IoCs

Processes:

wscript.exe

flow	pid	process
5	1204	wscript.exe
8	1204	wscript.exe
9	1204	wscript.exe
10	1204	wscript.exe
11	1204	wscript.exe
12	1204	wscript.exe
13	1204	wscript.exe
14	1204	wscript.exe
16	1204	wscript.exe
17	1204	wscript.exe
18	1204	wscript.exe
19	1204	wscript.exe
20	1204	wscript.exe
21	1204	wscript.exe
23	1204	wscript.exe
24	1204	wscript.exe
25	1204	wscript.exe
26	1204	wscript.exe
27	1204	wscript.exe
28	1204	wscript.exe
30	1204	wscript.exe
31	1204	wscript.exe
32	1204	wscript.exe
33	1204	wscript.exe
34	1204	wscript.exe
35	1204	wscript.exe
37	1204	wscript.exe
38	1204	wscript.exe

Drops startup file 1 IoCs

Processes:

wscript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Order2021.js wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Order2021.js
1⤵
- Blocklisted process makes network request
- Drops startup file
PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-2-0x000007FEF5E00000-0x000007FEF607A000-memory.dmp

Filesize
2.5MB

Download