Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
19-04-2021 06:17
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.js
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ.js
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
RFQ.js
-
Size
3KB
-
MD5
f68bfaf10007b75b933c2a2acab4d54c
-
SHA1
7cabe5b37ea9d22450e80d41378c5e8eefa7eea5
-
SHA256
a89127ec0c19df41166916cfa4c199d97eade3ec4f0cf4d2281408cfe2790c2a
-
SHA512
7ea74f93293e6171338e896243e2ecb696c6b4fbd7cfeffba6e0312a4b8c3789a949e9a0e4e8a566f946d36ebaad59d8477fcaf7681e91b9cc399ff865219a8d
Score
10/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 5 1668 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\U1FBR8C2J2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RFQ.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1668 wrote to memory of 664 1668 wscript.exe schtasks.exe PID 1668 wrote to memory of 664 1668 wscript.exe schtasks.exe PID 1668 wrote to memory of 664 1668 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\RFQ.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/664-59-0x0000000000000000-mapping.dmp