Analysis
-
max time kernel
151s -
max time network
174s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
31-08-2021 08:29
Static task
static1
Behavioral task
behavioral1
Sample
45678-INVOICE.js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
45678-INVOICE.js
Resource
win10v20210408
General
-
Target
45678-INVOICE.js
-
Size
31KB
-
MD5
05928625d3fe939ab6193d512b5b5d40
-
SHA1
9bc4473a08f10d3637a81f14728260d04d0978f4
-
SHA256
94141506892544ed661a863292f5497e99a094efd9ca7c96cb64439a5d1af575
-
SHA512
da25f7a9fa999fb48e095a0d61d15a640d50801a158479e5b7fa08b50fb1c901fc031819f18435817cf98f72e665183b194216f61f225beb0e5c821b47ed85c8
Malware Config
Signatures
-
Blocklisted process makes network request 46 IoCs
Processes:
wscript.exewscript.exeflow pid process 8 1252 wscript.exe 9 1944 wscript.exe 10 1944 wscript.exe 12 1252 wscript.exe 13 1944 wscript.exe 14 1944 wscript.exe 16 1252 wscript.exe 18 1944 wscript.exe 19 1944 wscript.exe 21 1252 wscript.exe 23 1944 wscript.exe 25 1252 wscript.exe 26 1944 wscript.exe 28 1252 wscript.exe 29 1944 wscript.exe 31 1944 wscript.exe 33 1252 wscript.exe 34 1944 wscript.exe 35 1944 wscript.exe 37 1252 wscript.exe 39 1944 wscript.exe 40 1944 wscript.exe 42 1252 wscript.exe 44 1944 wscript.exe 46 1252 wscript.exe 47 1944 wscript.exe 49 1252 wscript.exe 50 1944 wscript.exe 51 1944 wscript.exe 53 1252 wscript.exe 56 1944 wscript.exe 57 1944 wscript.exe 58 1252 wscript.exe 60 1944 wscript.exe 62 1252 wscript.exe 63 1944 wscript.exe 65 1252 wscript.exe 66 1944 wscript.exe 68 1944 wscript.exe 71 1252 wscript.exe 72 1944 wscript.exe 73 1944 wscript.exe 75 1252 wscript.exe 76 1944 wscript.exe 77 1944 wscript.exe 78 1252 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\laeapoOSVO.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\laeapoOSVO.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\laeapoOSVO.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1944 wrote to memory of 1252 1944 wscript.exe wscript.exe PID 1944 wrote to memory of 1252 1944 wscript.exe wscript.exe PID 1944 wrote to memory of 1252 1944 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\45678-INVOICE.js1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\laeapoOSVO.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\laeapoOSVO.jsMD5
e2f8f780d50a72b875b0abc09a17e722
SHA12a855bde603dc98064d74b0710cf3efb26fa213d
SHA256c9241561fc88d183db872fb1daa5438b5d836a2b16cf020ac011099a95d2a6cc
SHA512065fb5584160fc053d792896700c50c244da2a9655fb893dc76fc3a2e200d825b00bceebf8dd9960e203b76e6cd7ab1d6afb98b74e7b078876e34446e4149bf1
-
memory/1252-59-0x0000000000000000-mapping.dmp