Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
02-09-2021 04:42
Static task
static1
Behavioral task
behavioral1
Sample
INVCDVNC.js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
INVCDVNC.js
Resource
win10v20210408
General
-
Target
INVCDVNC.js
-
Size
31KB
-
MD5
bb7c26d5d96eb62f3a624b75dc8469d4
-
SHA1
a91187d1b7c7594bf6abf86c304445be874ac1f0
-
SHA256
0a55d489ecb61684e15a631f04e7bf5c59e804fdd8419d1dfe1bba60bc43a8db
-
SHA512
2580a12cea3a8df1f4fff0a7886b47d8016cde04497ee043e85c056fa9becf1ff1319161cbecac535b5e0d8f4653a6fc31fc7c2b14d384b4e7fd152b3ec19aaa
Malware Config
Signatures
-
Blocklisted process makes network request 19 IoCs
Processes:
wscript.exewscript.exeflow pid process 12 1400 wscript.exe 13 3568 wscript.exe 15 3568 wscript.exe 19 3568 wscript.exe 20 3568 wscript.exe 21 3568 wscript.exe 22 3568 wscript.exe 23 3568 wscript.exe 24 3568 wscript.exe 25 3568 wscript.exe 26 3568 wscript.exe 27 3568 wscript.exe 28 3568 wscript.exe 29 3568 wscript.exe 30 3568 wscript.exe 31 3568 wscript.exe 32 3568 wscript.exe 33 3568 wscript.exe 34 3568 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IDNoNZhVzI.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IDNoNZhVzI.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\IDNoNZhVzI.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
wscript.exedescription pid process target process PID 1400 wrote to memory of 3568 1400 wscript.exe wscript.exe PID 1400 wrote to memory of 3568 1400 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\INVCDVNC.js1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\IDNoNZhVzI.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:3568
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\IDNoNZhVzI.jsMD5
f3b49707117e05ac2d64d61088edacd4
SHA1e3493dd639be8105d2e819bcb04d0a1a1b146671
SHA25679e67e9c0769a3007b8a639f262bb63613c3d6c35ed628a90db419ea6d590e74
SHA51293c4680f62aee9a7f509d8379ee1a6a37eb013342855d1d64b040b0502558c1b4b732b8583f1fa2dc05ee6215ef55d24c6a90d6130e1b4dd6197a7de5af8336c
-
memory/3568-114-0x0000000000000000-mapping.dmp