Analysis
-
max time kernel
145s -
max time network
182s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-10-2021 18:44
Static task
static1
Behavioral task
behavioral1
Sample
H6X8V4C3C02M.PDF..js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
H6X8V4C3C02M.PDF..js
Resource
win10v20210408
General
-
Target
H6X8V4C3C02M.PDF..js
-
Size
81KB
-
MD5
0448be9d3f5813d311fcdd8bb5d190ca
-
SHA1
1390e1726b9826b8c49a3f9519e7c04264f7c199
-
SHA256
c560351620b68f01085c6b449e5256c617ea7eed70451f6c08900c694c08b92e
-
SHA512
b6efdcb0198e3ae004516d2642acf39dd8f25ac80b8f36b14bd2b32306743ff1b9cefa7680d3b5b78f81a911be42942b27950eaddba45a3366f8bce2509769b6
Malware Config
Extracted
vjw0rm
http://7700js.duckdns.org:7700
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 8 1660 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H6X8V4C3C02M.PDF..js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H6X8V4C3C02M.PDF..js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\FM24ZGX1AP = "'C:\\Users\\Admin\\AppData\\Local\\Temp\\H6X8V4C3C02M.PDF..js'" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1660 wrote to memory of 1772 1660 wscript.exe schtasks.exe PID 1660 wrote to memory of 1772 1660 wscript.exe schtasks.exe PID 1660 wrote to memory of 1772 1660 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\H6X8V4C3C02M.PDF..js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\Admin\AppData\Local\Temp\H6X8V4C3C02M.PDF..js2⤵
- Creates scheduled task(s)