Analysis
-
max time kernel
143s -
max time network
173s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
03-08-2021 06:06
Static task
static1
Behavioral task
behavioral1
Sample
Company Profile Shelton 3.5-pdf.js
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Company Profile Shelton 3.5-pdf.js
Resource
win10v20210408
General
-
Target
Company Profile Shelton 3.5-pdf.js
-
Size
19KB
-
MD5
136475f8c1a1c7f23d87ea255926df15
-
SHA1
a2f0c5d389116df32e96c5e03210c370ea04da09
-
SHA256
ef941e9a12dd57020e8c110e4978fb953b3d41f482f650184980318676fd0408
-
SHA512
577ea90c902e95dd8ce1bf8227fad2439023d52733c57ccf3d1fe20e21c19b14529f1e23e75ef756b28c0c83d03c1a0a0e09ab5d04208a019647c15a2f5b070e
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
wscript.exewscript.exeflow pid process 8 1372 wscript.exe 9 1720 wscript.exe -
Drops startup file 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Profile Shelton 3.5-pdf.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Company Profile Shelton 3.5-pdf.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDOoLbqFXE.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDOoLbqFXE.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\B02N3ZE1UL = "\"C:\\Users\\Admin\\AppData\\Roaming\\HDOoLbqFXE.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\4UXUFTLXXY = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Company Profile Shelton 3.5-pdf.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 1720 wrote to memory of 1372 1720 wscript.exe wscript.exe PID 1720 wrote to memory of 1372 1720 wscript.exe wscript.exe PID 1720 wrote to memory of 1372 1720 wscript.exe wscript.exe PID 1720 wrote to memory of 656 1720 wscript.exe schtasks.exe PID 1720 wrote to memory of 656 1720 wscript.exe schtasks.exe PID 1720 wrote to memory of 656 1720 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Company Profile Shelton 3.5-pdf.js"1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\HDOoLbqFXE.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\Company Profile Shelton 3.5-pdf.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\HDOoLbqFXE.jsMD5
ceeeec8799d66c2d6b0b63cf3fb7d639
SHA146126751e39598977890ddd9bfdff6249003e03e
SHA2568f8adf65125e8492b2af0ad5953214880aabb6f8718a9bed0d3723507c360701
SHA512fde12c110bbac932aad37e859ce43e2299def8555fe85e42155d34198fccf8038b459217b183ea223dadc6db7e715a14a7a743b7e85e6ae22844dc1a86f117e1
-
memory/656-62-0x0000000000000000-mapping.dmp
-
memory/1372-60-0x0000000000000000-mapping.dmp