Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-08-2021 12:36
Static task
static1
Behavioral task
behavioral1
Sample
Proof of payment.js
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
Proof of payment.js
-
Size
23KB
-
MD5
8fdc868b35a760294af50f21f3a36337
-
SHA1
644818ad3b6d733c34ac2f5e11741bb72c1498f7
-
SHA256
63426a314efd8585245ae432e2041dbde96bf69b2dc39dddeea63271bef027c2
-
SHA512
3e2cbd90575b177ab74e0990aa273db548f98b757bf0547445c51d945c52e9bf72ff96a556967b5d09a8dfae500f1d5fe1a6a4fd4a0be5ae180576f989cf772c
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 7 1272 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proof of payment.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proof of payment.js wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.