Analysis
-
max time kernel
1796s -
max time network
1797s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
24-04-2021 19:55
Static task
static1
Behavioral task
behavioral1
Sample
6W5MPAEEPH.js
Resource
win7v20210410
General
-
Target
6W5MPAEEPH.js
-
Size
10KB
-
MD5
478634c9781a93f5c34e70623a62ee1e
-
SHA1
ed996dd6ea02d176c46c01f17ebe19c217d3ce5e
-
SHA256
58f2aec1d4020c14b45c8357512b8787eed4a4d208497d6866c29ee2f4f24cfb
-
SHA512
e3ba328dcf8f7766fe9e1b471cc9cd08d24da3d4b4e584262ed1ec4c8fbc972fd9d60e39c7f138390316d61f8292520900fa1b3d5fc0f65dc00dd85a08d6cacd
Malware Config
Signatures
-
Blocklisted process makes network request 9 IoCs
Processes:
wscript.exeWScript.exeflow pid process 5 1084 wscript.exe 6 1084 wscript.exe 7 1084 wscript.exe 8 1084 wscript.exe 9 1084 wscript.exe 10 1084 wscript.exe 11 1084 wscript.exe 13 1084 wscript.exe 15 284 WScript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exeWScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6W5MPAEEPH.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6W5MPAEEPH.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6W5MPAEEPH.js WScript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
WScript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\OXKHGDB6LZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6W5MPAEEPH.js\"" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\OXKHGDB6LZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6W5MPAEEPH.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1576 schtasks.exe 1380 schtasks.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
wscript.exetaskeng.exeWScript.exedescription pid process target process PID 1084 wrote to memory of 1576 1084 wscript.exe schtasks.exe PID 1084 wrote to memory of 1576 1084 wscript.exe schtasks.exe PID 1084 wrote to memory of 1576 1084 wscript.exe schtasks.exe PID 1860 wrote to memory of 284 1860 taskeng.exe WScript.exe PID 1860 wrote to memory of 284 1860 taskeng.exe WScript.exe PID 1860 wrote to memory of 284 1860 taskeng.exe WScript.exe PID 284 wrote to memory of 1380 284 WScript.exe schtasks.exe PID 284 wrote to memory of 1380 284 WScript.exe schtasks.exe PID 284 wrote to memory of 1380 284 WScript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\6W5MPAEEPH.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\6W5MPAEEPH.js2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {0BBF30AC-D41A-4A54-9CBF-CF664664E8F1} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\6W5MPAEEPH.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\6W5MPAEEPH.js3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6W5MPAEEPH.jsMD5
478634c9781a93f5c34e70623a62ee1e
SHA1ed996dd6ea02d176c46c01f17ebe19c217d3ce5e
SHA25658f2aec1d4020c14b45c8357512b8787eed4a4d208497d6866c29ee2f4f24cfb
SHA512e3ba328dcf8f7766fe9e1b471cc9cd08d24da3d4b4e584262ed1ec4c8fbc972fd9d60e39c7f138390316d61f8292520900fa1b3d5fc0f65dc00dd85a08d6cacd
-
memory/284-61-0x0000000000000000-mapping.dmp
-
memory/1380-62-0x0000000000000000-mapping.dmp
-
memory/1576-59-0x0000000000000000-mapping.dmp
-
memory/1860-60-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmpFilesize
8KB