ostap | c16916fbad3101fbbb241ec7a8ebbb5e46288a6dfeed80c70e47127d1ae9b965 | Triage

Analysis

max time kernel
131s
max time network
132s
platform
windows7_x64
resource
win7v20201028
submitted
01-02-2021 20:35

Sharing

Report Analysis Logs

General

Target

readme.js
Size

843KB
MD5

871b84c3e9c24b706b51eb717ee50627
SHA1

696ff0a47d733e11a1468ee898ff31c9c27a9937
SHA256

c16916fbad3101fbbb241ec7a8ebbb5e46288a6dfeed80c70e47127d1ae9b965
SHA512

7e15b8e85b084cdc30990f696e5d9be6c67c457a89a47043e379209fb6a31446a1e6a75e3195b77037f0f703f33f6dcfca7c6ce10f68f617527673ec2956cee1

Score

10^/10

ostap downloader

Malware Config

Signatures

ostap
Ostap is a JS downloader, used to deliver other families.
downloader ostap
Blocklisted process makes network request 4 IoCs

Processes:

wscript.exe

flow pid process

4 2044 wscript.exe
5 2044 wscript.exe
6 2044 wscript.exe
7 2044 wscript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\readme.js
1⤵
- Blocklisted process makes network request
PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...