Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
12-10-2021 16:16
Static task
static1
Behavioral task
behavioral1
Sample
H6X8V4C3C02M.PDF..js
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
H6X8V4C3C02M.PDF..js
Resource
win10v20210408
General
-
Target
H6X8V4C3C02M.PDF..js
-
Size
81KB
-
MD5
0448be9d3f5813d311fcdd8bb5d190ca
-
SHA1
1390e1726b9826b8c49a3f9519e7c04264f7c199
-
SHA256
c560351620b68f01085c6b449e5256c617ea7eed70451f6c08900c694c08b92e
-
SHA512
b6efdcb0198e3ae004516d2642acf39dd8f25ac80b8f36b14bd2b32306743ff1b9cefa7680d3b5b78f81a911be42942b27950eaddba45a3366f8bce2509769b6
Malware Config
Signatures
-
Blocklisted process makes network request 18 IoCs
Processes:
wscript.exeflow pid process 8 656 wscript.exe 24 656 wscript.exe 33 656 wscript.exe 34 656 wscript.exe 35 656 wscript.exe 36 656 wscript.exe 37 656 wscript.exe 39 656 wscript.exe 40 656 wscript.exe 41 656 wscript.exe 42 656 wscript.exe 43 656 wscript.exe 44 656 wscript.exe 45 656 wscript.exe 46 656 wscript.exe 47 656 wscript.exe 48 656 wscript.exe 49 656 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H6X8V4C3C02M.PDF..js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H6X8V4C3C02M.PDF..js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\FM24ZGX1AP = "'C:\\Users\\Admin\\AppData\\Local\\Temp\\H6X8V4C3C02M.PDF..js'" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
wscript.exedescription pid process target process PID 656 wrote to memory of 2052 656 wscript.exe schtasks.exe PID 656 wrote to memory of 2052 656 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\H6X8V4C3C02M.PDF..js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\Admin\AppData\Local\Temp\H6X8V4C3C02M.PDF..js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2052-114-0x0000000000000000-mapping.dmp