Analysis
-
max time kernel
153s -
max time network
177s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
03-09-2021 02:07
Static task
static1
Behavioral task
behavioral1
Sample
Detailedzmc.js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Detailedzmc.js
Resource
win10v20210408
General
-
Target
Detailedzmc.js
-
Size
31KB
-
MD5
67fbad40453a19402d1989cfd18c769c
-
SHA1
a6a7980d2200573fa05bd4d00b3bd73445fad99a
-
SHA256
9e08b5396987899e20119e6baa726653c3e03c85772e5f07a71b586338d6e110
-
SHA512
0df4845e96ca72aa227f11215fc7a340eab5dc687954d86d963e5ef3149a7991582b0626aa5657773e7a15ce0898a71b411726eb6ee585a53aa71b301c58472d
Malware Config
Signatures
-
Blocklisted process makes network request 19 IoCs
Processes:
wscript.exewscript.exeflow pid process 8 688 wscript.exe 9 2024 wscript.exe 11 688 wscript.exe 13 688 wscript.exe 16 688 wscript.exe 18 688 wscript.exe 19 688 wscript.exe 22 688 wscript.exe 25 688 wscript.exe 27 688 wscript.exe 30 688 wscript.exe 31 688 wscript.exe 34 688 wscript.exe 36 688 wscript.exe 39 688 wscript.exe 40 688 wscript.exe 43 688 wscript.exe 46 688 wscript.exe 48 688 wscript.exe -
Drops startup file 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Detailedzmc.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Detailedzmc.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uLBxnntOnW.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uLBxnntOnW.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\uLBxnntOnW.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 2024 wrote to memory of 688 2024 wscript.exe wscript.exe PID 2024 wrote to memory of 688 2024 wscript.exe wscript.exe PID 2024 wrote to memory of 688 2024 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Detailedzmc.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\uLBxnntOnW.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\uLBxnntOnW.jsMD5
4384461e0d76c05ce635c8ec2e462501
SHA1c060bc7c9661dc6d43abae5cd3a2ff966cc7716c
SHA256be21d9aba93c26c4c40c177e7fd3ce5c6b99f89a5e797a9cf030b3e25faa9ac5
SHA512313ef13aff7176a92e30b5362db402c7f531558b6820c3dd805d6e5f10186b0ddd94c18b835462727c0e9690b096c8ea8fc87ad262e116b30ac83ea9dee9ae62
-
memory/688-60-0x0000000000000000-mapping.dmp