Analysis
-
max time kernel
150s -
max time network
186s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
18-08-2021 17:26
Static task
static1
Behavioral task
behavioral1
Sample
SKM_C258201001130020005057.js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
SKM_C258201001130020005057.js
Resource
win10v20210410
General
-
Target
SKM_C258201001130020005057.js
-
Size
27KB
-
MD5
511f6a9de220c99adf7e2e03a4e48886
-
SHA1
7e3c217e99f7bdd44c2e760feaf413cb3a7736fb
-
SHA256
2a830c7923253031907c1dd34c4a9532c1f53e8fe7f6a3c8359a0e93ef4b216e
-
SHA512
8fe6e672872a208e9cac950856c1afa4cdb7fc496cc67531a98322fed1f1b83b1b7b5ce7f5a702b56197c853f0bf09deb5e1958b4369ca01cb42c401fdb4c090
Malware Config
Signatures
-
Blocklisted process makes network request 21 IoCs
Processes:
wscript.exewscript.exeflow pid process 10 2016 wscript.exe 11 1856 wscript.exe 12 1856 wscript.exe 13 1856 wscript.exe 16 1856 wscript.exe 17 1856 wscript.exe 18 1856 wscript.exe 21 1856 wscript.exe 22 1856 wscript.exe 24 1856 wscript.exe 26 1856 wscript.exe 27 1856 wscript.exe 28 1856 wscript.exe 30 1856 wscript.exe 32 1856 wscript.exe 33 1856 wscript.exe 36 1856 wscript.exe 37 1856 wscript.exe 38 2016 wscript.exe 39 2016 wscript.exe 40 1856 wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SKM_C258201001130020005057.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhOPzJgSgd.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhOPzJgSgd.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\3XFVC1CQKY = "\"C:\\Users\\Admin\\AppData\\Roaming\\SKM_C258201001130020005057.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\0HKX5ALWLG = "\"C:\\Users\\Admin\\AppData\\Roaming\\PhOPzJgSgd.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 2016 wrote to memory of 1856 2016 wscript.exe wscript.exe PID 2016 wrote to memory of 1856 2016 wscript.exe wscript.exe PID 2016 wrote to memory of 1856 2016 wscript.exe wscript.exe PID 2016 wrote to memory of 1476 2016 wscript.exe schtasks.exe PID 2016 wrote to memory of 1476 2016 wscript.exe schtasks.exe PID 2016 wrote to memory of 1476 2016 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\SKM_C258201001130020005057.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PhOPzJgSgd.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SKM_C258201001130020005057.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\PhOPzJgSgd.jsMD5
398ea7fcde0fe6de66a488b8d0df37b3
SHA1847de03f765f337624423386aa124e0910c22883
SHA2569bfbb43d7401e73169d525c90feb26e4d968a301cb7f6045535c8025f780d731
SHA512bc9a0491ea5c9f5aadb63e7a8811acebca4afeb9c1d76db985d2c7732c36ffe7e1fbb0cff970cabf51bc20db752cef847712b4147e8d0480014d1f7d3bb08111
-
memory/1476-62-0x0000000000000000-mapping.dmp
-
memory/1856-60-0x0000000000000000-mapping.dmp