Analysis
-
max time kernel
155s -
max time network
156s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
30-11-2021 06:27
Static task
static1
Behavioral task
behavioral1
Sample
Order32763.js
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Order32763.js
Resource
win10-en-20211104
General
-
Target
Order32763.js
-
Size
23KB
-
MD5
e4eb55ac626bc25b72296d2dd2b1f3fb
-
SHA1
7576d84093c04f1fe086100dc577d542fc7960d5
-
SHA256
a642b246cc03750cb7968703d5a17b8c3823599cfc78d9dcc7d6b8e613f98bb3
-
SHA512
f7f12bdeba8496182f06e26859b270d2d84b7435ef0bb5b2d867c272503f2c0755e4670044157cf3f542ae3bcaee534ec6a7b67c52f3d3f8d80ae830828eec8a
Malware Config
Extracted
vjw0rm
http://37.120.137.227:29563
Signatures
-
Blocklisted process makes network request 18 IoCs
Processes:
wscript.exewscript.exeflow pid process 7 948 wscript.exe 8 1508 wscript.exe 9 1508 wscript.exe 12 1508 wscript.exe 14 1508 wscript.exe 16 1508 wscript.exe 19 1508 wscript.exe 21 1508 wscript.exe 23 1508 wscript.exe 25 1508 wscript.exe 28 1508 wscript.exe 31 1508 wscript.exe 33 1508 wscript.exe 35 1508 wscript.exe 38 1508 wscript.exe 40 1508 wscript.exe 43 1508 wscript.exe 44 1508 wscript.exe -
Drops startup file 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Order32763.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Order32763.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EVyOkSchlF.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EVyOkSchlF.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\NCSH8GWAZB = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Order32763.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\EVyOkSchlF.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 948 wrote to memory of 1508 948 wscript.exe wscript.exe PID 948 wrote to memory of 1508 948 wscript.exe wscript.exe PID 948 wrote to memory of 1508 948 wscript.exe wscript.exe PID 948 wrote to memory of 1656 948 wscript.exe schtasks.exe PID 948 wrote to memory of 1656 948 wscript.exe schtasks.exe PID 948 wrote to memory of 1656 948 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Order32763.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\EVyOkSchlF.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\Order32763.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\EVyOkSchlF.jsMD5
1a2a06c9b9377f182094c437ccafd3de
SHA1923c7f81f8266f0753d6a7bf9591e06be5c35a4e
SHA256873d6b1b90d36b2bf0be2a34df85fba65c95267a0c07976ec5de4633bbdf4345
SHA512fcf37c4da3e954631997810be27809742a2a88df792f8a54b82ab21ca2a2958b0c5feb2e3497bc70a27050cb9519192304573e0a48d97fd669a4e27943106f84
-
memory/948-55-0x000007FEFBA71000-0x000007FEFBA73000-memory.dmpFilesize
8KB
-
memory/1508-56-0x0000000000000000-mapping.dmp
-
memory/1656-58-0x0000000000000000-mapping.dmp