Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
19-08-2021 13:06
Static task
static1
Behavioral task
behavioral1
Sample
fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85.js
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85.js
-
Size
19KB
-
MD5
40226ee8e5ccd983ec7446b068819477
-
SHA1
9417c77384776b685a98293d0416646b18dddf01
-
SHA256
fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85
-
SHA512
c09bdd3943bd724ac4e13fe6d32061cf54b0af7b726b6f777ba5621c57d6876db683a95ef2d7da95052a7284072f48dc8f5fbf0422d00e275c6026c097ab8cd1
Malware Config
Signatures
-
Blocklisted process makes network request 18 IoCs
Processes:
wscript.exeflow pid process 9 644 wscript.exe 17 644 wscript.exe 18 644 wscript.exe 19 644 wscript.exe 20 644 wscript.exe 21 644 wscript.exe 22 644 wscript.exe 23 644 wscript.exe 24 644 wscript.exe 25 644 wscript.exe 26 644 wscript.exe 27 644 wscript.exe 28 644 wscript.exe 29 644 wscript.exe 30 644 wscript.exe 31 644 wscript.exe 32 644 wscript.exe 33 644 wscript.exe -
Drops startup file 1 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85.js wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
wscript.exedescription pid process target process PID 644 wrote to memory of 492 644 wscript.exe schtasks.exe PID 644 wrote to memory of 492 644 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/492-114-0x0000000000000000-mapping.dmp