Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
02-12-2021 17:25
Static task
static1
Behavioral task
behavioral1
Sample
js-decoded-1.js
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
js-decoded-1.js
Resource
win10-en-20211104
General
-
Target
js-decoded-1.js
-
Size
19KB
-
MD5
38eef142a1b030c810b6f18bc1a6ae7a
-
SHA1
2d2ffe145c88bf1df437ae37b157f8eda7d9265e
-
SHA256
7953ed1095e83bed7ad65ef426e2119e47bcac5a65d6111aef8576d301df9797
-
SHA512
34c02223bae60c789d6417e541008de777f3a86aad8ff4ebe010ca6cc693f95e3b5641511832ea043efe5b6d3f71e14c78c36146a91d9892f973c10602c49ef8
Malware Config
Signatures
-
Blocklisted process makes network request 35 IoCs
Processes:
wscript.exewscript.exeflow pid process 8 1588 wscript.exe 9 376 wscript.exe 10 376 wscript.exe 12 1588 wscript.exe 14 376 wscript.exe 15 1588 wscript.exe 18 376 wscript.exe 20 1588 wscript.exe 21 376 wscript.exe 23 1588 wscript.exe 25 376 wscript.exe 26 1588 wscript.exe 29 376 wscript.exe 31 1588 wscript.exe 33 376 wscript.exe 34 1588 wscript.exe 36 376 wscript.exe 38 1588 wscript.exe 40 376 wscript.exe 42 1588 wscript.exe 43 376 wscript.exe 45 1588 wscript.exe 46 376 wscript.exe 49 1588 wscript.exe 51 376 wscript.exe 53 1588 wscript.exe 55 376 wscript.exe 56 1588 wscript.exe 57 376 wscript.exe 60 1588 wscript.exe 62 376 wscript.exe 64 1588 wscript.exe 66 376 wscript.exe 67 1588 wscript.exe 69 376 wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\js-decoded-1.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RRXVpOavDl.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RRXVpOavDl.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\RRXVpOavDl.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\0WENLYRIM2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\js-decoded-1.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 1588 wrote to memory of 376 1588 wscript.exe wscript.exe PID 1588 wrote to memory of 376 1588 wscript.exe wscript.exe PID 1588 wrote to memory of 376 1588 wscript.exe wscript.exe PID 1588 wrote to memory of 1172 1588 wscript.exe schtasks.exe PID 1588 wrote to memory of 1172 1588 wscript.exe schtasks.exe PID 1588 wrote to memory of 1172 1588 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\js-decoded-1.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\RRXVpOavDl.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:376 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\js-decoded-1.js2⤵
- Creates scheduled task(s)
PID:1172
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\RRXVpOavDl.jsMD5
dfdc9c79b321d87cc8dcbb361a69ecb5
SHA17d430e4ef2ecaf4db5e42789a56b2ea4e280b35c
SHA256f99f5c043620cf790857f1a2c8906a9323c57a5b6fa6a59acd571eb1bfc68328
SHA5124856afcf1953a9056253af8baa39b6d9283aa17153903c3c671785e51ac2ccf7aa104fac5e4c2fb4098d1f1ed6a9c9212cfe2ebbbbe6f46fc53ebec96537705f
-
memory/376-56-0x0000000000000000-mapping.dmp
-
memory/1172-58-0x0000000000000000-mapping.dmp
-
memory/1588-55-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmpFilesize
8KB