Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-09-2021 07:13
Static task
static1
Behavioral task
behavioral1
Sample
#T01.js
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
#T01.js
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
#T01.js
-
Size
9KB
-
MD5
920ad067eeb1b674efbddb5f576a3926
-
SHA1
3339cfccc26898a8e64130d5f784bae479804726
-
SHA256
080069323805f67a898f62517b17786d46cc51e9894cd490ee0ba789271e1d9c
-
SHA512
f5883a6bf47b14086d8a01f9bc3a7bbe5321a795605a8a843a81c714142d5d2362d0c047d6a03950d278a03981bc7a92ab69d04452278c26e6083e309b9f9d0a
Score
10/10
Malware Config
Signatures
-
Blocklisted process makes network request 26 IoCs
Processes:
wscript.exeflow pid process 4 1468 wscript.exe 5 1468 wscript.exe 6 1468 wscript.exe 7 1468 wscript.exe 8 1468 wscript.exe 9 1468 wscript.exe 11 1468 wscript.exe 12 1468 wscript.exe 13 1468 wscript.exe 14 1468 wscript.exe 15 1468 wscript.exe 16 1468 wscript.exe 18 1468 wscript.exe 19 1468 wscript.exe 20 1468 wscript.exe 21 1468 wscript.exe 22 1468 wscript.exe 23 1468 wscript.exe 25 1468 wscript.exe 26 1468 wscript.exe 27 1468 wscript.exe 28 1468 wscript.exe 29 1468 wscript.exe 30 1468 wscript.exe 32 1468 wscript.exe 33 1468 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\#T01.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\#T01.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\MGIVKRKXXP = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\#T01.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1468 wrote to memory of 1944 1468 wscript.exe schtasks.exe PID 1468 wrote to memory of 1944 1468 wscript.exe schtasks.exe PID 1468 wrote to memory of 1944 1468 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\#T01.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\#T01.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1944-54-0x0000000000000000-mapping.dmp