Analysis
-
max time kernel
159s -
max time network
162s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
30-11-2021 06:27
Static task
static1
Behavioral task
behavioral1
Sample
Order32763.js
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Order32763.js
Resource
win10-en-20211104
General
-
Target
Order32763.js
-
Size
23KB
-
MD5
e4eb55ac626bc25b72296d2dd2b1f3fb
-
SHA1
7576d84093c04f1fe086100dc577d542fc7960d5
-
SHA256
a642b246cc03750cb7968703d5a17b8c3823599cfc78d9dcc7d6b8e613f98bb3
-
SHA512
f7f12bdeba8496182f06e26859b270d2d84b7435ef0bb5b2d867c272503f2c0755e4670044157cf3f542ae3bcaee534ec6a7b67c52f3d3f8d80ae830828eec8a
Malware Config
Extracted
vjw0rm
http://37.120.137.227:29563
Signatures
-
Blocklisted process makes network request 19 IoCs
Processes:
wscript.exewscript.exeflow pid process 10 2684 wscript.exe 11 4080 wscript.exe 12 4080 wscript.exe 21 4080 wscript.exe 28 4080 wscript.exe 29 4080 wscript.exe 30 4080 wscript.exe 31 4080 wscript.exe 32 4080 wscript.exe 34 4080 wscript.exe 35 4080 wscript.exe 36 4080 wscript.exe 37 4080 wscript.exe 38 4080 wscript.exe 39 4080 wscript.exe 40 4080 wscript.exe 41 4080 wscript.exe 42 4080 wscript.exe 43 4080 wscript.exe -
Drops startup file 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EVyOkSchlF.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Order32763.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Order32763.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EVyOkSchlF.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\NCSH8GWAZB = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Order32763.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\EVyOkSchlF.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.exedescription pid process target process PID 2684 wrote to memory of 4080 2684 wscript.exe wscript.exe PID 2684 wrote to memory of 4080 2684 wscript.exe wscript.exe PID 2684 wrote to memory of 1004 2684 wscript.exe schtasks.exe PID 2684 wrote to memory of 1004 2684 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Order32763.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\EVyOkSchlF.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\Order32763.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\EVyOkSchlF.jsMD5
1a2a06c9b9377f182094c437ccafd3de
SHA1923c7f81f8266f0753d6a7bf9591e06be5c35a4e
SHA256873d6b1b90d36b2bf0be2a34df85fba65c95267a0c07976ec5de4633bbdf4345
SHA512fcf37c4da3e954631997810be27809742a2a88df792f8a54b82ab21ca2a2958b0c5feb2e3497bc70a27050cb9519192304573e0a48d97fd669a4e27943106f84
-
memory/1004-120-0x0000000000000000-mapping.dmp
-
memory/4080-118-0x0000000000000000-mapping.dmp