Analysis
-
max time kernel
146s -
max time network
196s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-06-2021 14:31
Static task
static1
Behavioral task
behavioral1
Sample
TBA1610955.js
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
TBA1610955.js
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
TBA1610955.js
-
Size
9KB
-
MD5
e3cb5fb484ec5e048872f59a9d48bcd3
-
SHA1
ecd7f55a9050d3af0110e857a2133507108c8609
-
SHA256
7437f9bdb9a271fc9fa6f4b165675e08d53c00e62a61e634c4ee34ed01b73b0a
-
SHA512
c13e9a7434afcb4436b560f3f58dc2cdf2934f688cd39c0065429dd680375b575fce55fcf31c70d08b345f64d56dc5d7955caa2e831bc8ad0b4c62547beb0523
Score
10/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 6 520 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TBA1610955.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TBA1610955.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\VK4NKWEXF7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TBA1610955.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 520 wrote to memory of 1640 520 wscript.exe schtasks.exe PID 520 wrote to memory of 1640 520 wscript.exe schtasks.exe PID 520 wrote to memory of 1640 520 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\TBA1610955.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\TBA1610955.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1640-59-0x0000000000000000-mapping.dmp