Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
16-06-2021 13:07
Static task
static1
Behavioral task
behavioral1
Sample
ZXOMHSJOPMA.js
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ZXOMHSJOPMA.js
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
ZXOMHSJOPMA.js
-
Size
9KB
-
MD5
e7b6b4fb18ab115e2f55b97830202746
-
SHA1
9c25aa6c5cce3445c8a08a84e35eece1a2050ab7
-
SHA256
410a7f406af3ce89f468bec2eefc1de50f424344019a5395d3b9e2d9429d2c94
-
SHA512
d3434d6c7d6541670b37d3fb516f83fa5b45d432d15f215a9eb8879089e1d7a375a15bdf6bc1d0c8762671ac3d55836f90a5745d2241a95f116f92591bc1c52c
Score
10/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 21 1268 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZXOMHSJOPMA.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZXOMHSJOPMA.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\VQFSTDUJ0B = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ZXOMHSJOPMA.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1268 wrote to memory of 1628 1268 wscript.exe schtasks.exe PID 1268 wrote to memory of 1628 1268 wscript.exe schtasks.exe PID 1268 wrote to memory of 1628 1268 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ZXOMHSJOPMA.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\ZXOMHSJOPMA.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1628-60-0x0000000000000000-mapping.dmp