cbbe0024954f1de4b97faad7f7bff8bddce3aa4c71d190dfb6819b58d365a144 | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10_x64
resource
win10v20201028
submitted
13-01-2021 06:51

Sharing

Report Analysis Logs

General

Target

Order2021.js
Size

28KB
MD5

62247f049cfae09bceae111f086458fd
SHA1

3237692834c839beccfa746dba2fc5024d874616
SHA256

cbbe0024954f1de4b97faad7f7bff8bddce3aa4c71d190dfb6819b58d365a144
SHA512

3cd93a13099a1d599081f88bb90a5374f640fcb640b05a3ccea55a9eb8b419f089ad01de3f282da4887fcdf1aaec7ea4bf27eac7a33db9a06f99bf6cd44cf4f7

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 20 IoCs

Processes:

wscript.exe

flow	pid	process
8	984	wscript.exe
11	984	wscript.exe
13	984	wscript.exe
16	984	wscript.exe
23	984	wscript.exe
26	984	wscript.exe
27	984	wscript.exe
28	984	wscript.exe
29	984	wscript.exe
31	984	wscript.exe
35	984	wscript.exe
36	984	wscript.exe
37	984	wscript.exe
38	984	wscript.exe
39	984	wscript.exe
40	984	wscript.exe
41	984	wscript.exe
42	984	wscript.exe
43	984	wscript.exe
44	984	wscript.exe

Drops startup file 1 IoCs

Processes:

wscript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Order2021.js wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Order2021.js
1⤵
- Blocklisted process makes network request
- Drops startup file
PID:984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads