Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
06-12-2021 16:57
Static task
static1
Behavioral task
behavioral1
Sample
ZXRTBNUOO1.js
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
ZXRTBNUOO1.js
Resource
win10-en-20211014
General
-
Target
ZXRTBNUOO1.js
-
Size
9KB
-
MD5
46d001587dd33056afb6dd4f8ace0310
-
SHA1
6f7b364e422b91bfdc5321fcff95438223da153c
-
SHA256
e913fbfe0af0074695ba3d6d8306f5ab24699df20c0fd2309dc3c3aa80d3271c
-
SHA512
8ce90351d129bb7c999afd8f4ee48f6fed4e710921b9d2597206939b52d335cc97ffb13e859eca5b0721cacd1fce60b2e90392616ea64b43cb430451c318def3
Malware Config
Extracted
vjw0rm
http://marshjohn989.duckdns.org:7920
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 5 1908 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZXRTBNUOO1.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZXRTBNUOO1.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\GBOMHGW4UC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ZXRTBNUOO1.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1908 wrote to memory of 1328 1908 wscript.exe schtasks.exe PID 1908 wrote to memory of 1328 1908 wscript.exe schtasks.exe PID 1908 wrote to memory of 1328 1908 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ZXRTBNUOO1.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\ZXRTBNUOO1.js2⤵
- Creates scheduled task(s)
PID:1328
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1328-55-0x0000000000000000-mapping.dmp