Analysis
-
max time kernel
145s -
max time network
182s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
14-10-2021 18:01
Static task
static1
Behavioral task
behavioral1
Sample
F2JC6A4V49B7.js
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
F2JC6A4V49B7.js
-
Size
81KB
-
MD5
e9e4fc8abb66f8c5fcf22de751661a85
-
SHA1
0473d2d0d1049d350c0c4bf7d14abad002425106
-
SHA256
f3238d349b2650f8e0446a2f73ef3d3fefec5d40268ebdf7eb42bc2ac8adec9e
-
SHA512
0d5253b9892eaa58c0622712978e9fee38e2e38ab6756b63936b6878fc7b65439e6567a65b2fdb39baff4b1e22bb81afba1344396e66f155bacded0c12bc5334
Score
10/10
Malware Config
Extracted
Family
vjw0rm
C2
http://6800js.duckdns.org:6800
Signatures
-
Blocklisted process makes network request 9 IoCs
Processes:
wscript.exeflow pid process 5 984 wscript.exe 7 984 wscript.exe 9 984 wscript.exe 12 984 wscript.exe 14 984 wscript.exe 20 984 wscript.exe 22 984 wscript.exe 24 984 wscript.exe 26 984 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F2JC6A4V49B7.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F2JC6A4V49B7.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\BYK43BSFUJ = "'C:\\Users\\Admin\\AppData\\Local\\Temp\\F2JC6A4V49B7.js'" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 984 wrote to memory of 1748 984 wscript.exe schtasks.exe PID 984 wrote to memory of 1748 984 wscript.exe schtasks.exe PID 984 wrote to memory of 1748 984 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\F2JC6A4V49B7.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\Admin\AppData\Local\Temp\F2JC6A4V49B7.js2⤵
- Creates scheduled task(s)