Analysis
-
max time kernel
136s -
max time network
181s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
14-08-2021 06:51
Static task
static1
Behavioral task
behavioral1
Sample
W091.js
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
W091.js
Resource
win10v20210408
0 signatures
0 seconds
General
-
Target
W091.js
-
Size
12KB
-
MD5
173fd53dae86a5a6b7c4af3e08c06539
-
SHA1
601f17247f330e78776eaa58fbd6fa1a3fbdf9f8
-
SHA256
c3e72d149e6ee949a7118dec62a17b6a8513d244cf593381fbaca3890f64e6d7
-
SHA512
a6af8383cfe37f27881573898aca705d1bbdc900da5ac42507ece882a08c6fdd4b48d295d9906def91bf4938c8a96411a64199a651f8bdf26927841694436cbc
Score
10/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 6 1840 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\W091.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\W091.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\O3FNWNFPWY = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\W091.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1840 wrote to memory of 592 1840 wscript.exe schtasks.exe PID 1840 wrote to memory of 592 1840 wscript.exe schtasks.exe PID 1840 wrote to memory of 592 1840 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\W091.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\W091.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/592-60-0x0000000000000000-mapping.dmp