Analysis
-
max time kernel
151s -
max time network
175s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
01-09-2021 04:44
Static task
static1
Behavioral task
behavioral1
Sample
extracted.js
Resource
win7v20210410
Behavioral task
behavioral2
Sample
extracted.js
Resource
win10v20210408
General
-
Target
extracted.js
-
Size
18KB
-
MD5
1d9327d69fd263ac645b6a4eef31cb24
-
SHA1
3cff6c8d464e8c254048635dd68e31225ffcb6e4
-
SHA256
b302998fc5e3ff4a61d22f5c35ea5e168e040d10bc8437cf8c190bfc27e63dd0
-
SHA512
50cf6ff55a3f73803b4b1313c029e08e66e62ff6de1fd839fec21aecc09d30254616a3b8aab271828a7a69f4835d155ee4af53bb3c4daaa3b4a1cb2305409e2f
Malware Config
Signatures
-
Blocklisted process makes network request 19 IoCs
Processes:
wscript.exewscript.exeflow pid process 8 1464 wscript.exe 9 2028 wscript.exe 11 1464 wscript.exe 13 1464 wscript.exe 15 1464 wscript.exe 17 1464 wscript.exe 19 1464 wscript.exe 22 1464 wscript.exe 25 1464 wscript.exe 27 1464 wscript.exe 29 1464 wscript.exe 32 1464 wscript.exe 34 1464 wscript.exe 36 1464 wscript.exe 39 1464 wscript.exe 41 1464 wscript.exe 43 1464 wscript.exe 46 1464 wscript.exe 48 1464 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amqolYPJMq.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amqolYPJMq.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\amqolYPJMq.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 2028 wrote to memory of 1464 2028 wscript.exe wscript.exe PID 2028 wrote to memory of 1464 2028 wscript.exe wscript.exe PID 2028 wrote to memory of 1464 2028 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\extracted.js1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\amqolYPJMq.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\amqolYPJMq.jsMD5
3f7b92769fc59d8adc125b4d4e8adee4
SHA1b3ea6913dcf3681572a1db1f429cc5e1e49b060e
SHA256e1fccde6528046c2c1e41096085c199efaddc1393d42f6696165aeec43c9a209
SHA512659caad97e885af9d5f2dece465873b517fc34a5c67f5f0aba08b9ef868cca57fe025ed9979bd0933e46ee45792d5b424bd99a24c4449c5b739f17e0b6bdf01f
-
memory/1464-61-0x0000000000000000-mapping.dmp
-
memory/2028-60-0x000007FEFC411000-0x000007FEFC413000-memory.dmpFilesize
8KB