Analysis
-
max time kernel
138s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
15-04-2021 17:52
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE#00725678.js
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
INVOICE#00725678.js
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
INVOICE#00725678.js
-
Size
3KB
-
MD5
a7705ae531841779f8054c912b6f7ad0
-
SHA1
ce8cc2255fc7876a132e8aca56888092e2dff222
-
SHA256
b1024826ead65baa94ffbc7278ef7916504bf53f54b65fdfcd0d5189ad01e7c7
-
SHA512
d8b0ca966bb2054bb923ce5a4635605dc945cd0f2e68f63df9f0e23fb68e51285638fe60c7d8f220f3a2a1d16f25bc6d19e3eff5bf13b88e31eee34f8ff9b03c
Score
10/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 6 1964 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\INVOICE#00725678.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\INVOICE#00725678.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Q84HIXRRUK = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\INVOICE#00725678.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1964 wrote to memory of 272 1964 wscript.exe schtasks.exe PID 1964 wrote to memory of 272 1964 wscript.exe schtasks.exe PID 1964 wrote to memory of 272 1964 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\INVOICE#00725678.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\INVOICE#00725678.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/272-60-0x0000000000000000-mapping.dmp