Analysis
-
max time kernel
297s -
max time network
300s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-08-2021 15:38
Static task
static1
Behavioral task
behavioral1
Sample
SKM_C258201001130020005057.js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
SKM_C258201001130020005057.js
Resource
win10v20210410
General
-
Target
SKM_C258201001130020005057.js
-
Size
469KB
-
MD5
8fed7262f75ec7c978a03e8177dfadab
-
SHA1
3c95b2b69114082581b28a34533cbcddefd72516
-
SHA256
7a2fd40a032e726bde8638b079963c499d20c7c197a0f91544f458977fbd3304
-
SHA512
22a2ca24da0dd5d7a665d84fc58cc36013716d4605518f3c035d0bc5e6944825267e332708eb26623cba4e2d7b57b395caab6c5628b9e88f510fb23a8871e9f2
Malware Config
Signatures
-
Blocklisted process makes network request 35 IoCs
Processes:
WScript.exeflow pid process 7 1200 WScript.exe 8 1200 WScript.exe 9 1200 WScript.exe 11 1200 WScript.exe 12 1200 WScript.exe 13 1200 WScript.exe 15 1200 WScript.exe 16 1200 WScript.exe 17 1200 WScript.exe 19 1200 WScript.exe 20 1200 WScript.exe 21 1200 WScript.exe 23 1200 WScript.exe 24 1200 WScript.exe 25 1200 WScript.exe 27 1200 WScript.exe 28 1200 WScript.exe 29 1200 WScript.exe 31 1200 WScript.exe 32 1200 WScript.exe 33 1200 WScript.exe 35 1200 WScript.exe 36 1200 WScript.exe 37 1200 WScript.exe 39 1200 WScript.exe 40 1200 WScript.exe 41 1200 WScript.exe 43 1200 WScript.exe 44 1200 WScript.exe 45 1200 WScript.exe 47 1200 WScript.exe 48 1200 WScript.exe 49 1200 WScript.exe 51 1200 WScript.exe 52 1200 WScript.exe -
Drops startup file 2 IoCs
Processes:
WScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kgjBVaIrAu.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kgjBVaIrAu.js WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\0HKX5ALWLG = "\"C:\\Users\\Admin\\AppData\\Roaming\\kgjBVaIrAu.js\"" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 364 1628 WerFault.exe javaw.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 364 WerFault.exe 364 WerFault.exe 364 WerFault.exe 364 WerFault.exe 364 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 364 WerFault.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
wscript.exejavaw.exedescription pid process target process PID 1028 wrote to memory of 1200 1028 wscript.exe WScript.exe PID 1028 wrote to memory of 1200 1028 wscript.exe WScript.exe PID 1028 wrote to memory of 1200 1028 wscript.exe WScript.exe PID 1028 wrote to memory of 1628 1028 wscript.exe javaw.exe PID 1028 wrote to memory of 1628 1028 wscript.exe javaw.exe PID 1028 wrote to memory of 1628 1028 wscript.exe javaw.exe PID 1628 wrote to memory of 364 1628 javaw.exe WerFault.exe PID 1628 wrote to memory of 364 1628 javaw.exe WerFault.exe PID 1628 wrote to memory of 364 1628 javaw.exe WerFault.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\SKM_C258201001130020005057.js1⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\kgjBVaIrAu.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1200 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ibyzegjnrp.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1628 -s 1403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:364
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ibyzegjnrp.txtMD5
e38670aa13e73105b5b518779c4983df
SHA1dbed21eea88ad1574999e3db2b6d7eb19b5a2979
SHA256e0141d12da8d9172a5ea7bad725a5f0c4a766473b914d1f6b2b1485a7eeadf8f
SHA512f2fa507968f7c817ca55001215610a39cebd35ab76696593f87efc7f504572e2da3cdf5355c80cb420eb767dee950b5a7b71f83ba898ac08ac11f6be099c397e
-
C:\Users\Admin\AppData\Roaming\kgjBVaIrAu.jsMD5
f74ee95cc8fbe51c705384a7dcc5a701
SHA1b15a636ca2ce2f45dd466e5ee463f1cfed9fd64b
SHA256a86309235858dbc9f91f1a8405a3599a70f2394b7671889c9f6a1b05831c3407
SHA512e68783102258f983e31d4ffd7f4b532957072207dad9b892f388924d17e8909ac21cb59d823cd3dcedb066f69ac9053c8992cc40204f86798932eef2179d3ad6
-
memory/364-66-0x0000000000000000-mapping.dmp
-
memory/364-68-0x0000000000450000-0x0000000000451000-memory.dmpFilesize
4KB
-
memory/1028-60-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmpFilesize
8KB
-
memory/1200-61-0x0000000000000000-mapping.dmp
-
memory/1628-63-0x0000000000000000-mapping.dmp