Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
08/12/2021, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
js-decoded-1.js
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
js-decoded-1.js
Resource
win10-en-20211208
General
-
Target
js-decoded-1.js
-
Size
346KB
-
MD5
241d3041e2bb264cf886eff9fc3de24e
-
SHA1
7f3fe68b0ef727fca62441cff8eea28c5cd51941
-
SHA256
e817bd6a89f5bc3ee448e3c39e5c4739cf010bb815d087ecdd1b5e1f30c04959
-
SHA512
078b8f61b2afeefdf283d6e8f6b33986fc3500788b8d77e7672fc6aae70221ac140d850f91401a3e65a8996f49b4c9babdabac7071d7ea40adc84c62e9bbddc0
Malware Config
Signatures
-
Blocklisted process makes network request 13 IoCs
flow pid Process 5 428 WScript.exe 12 428 WScript.exe 13 428 WScript.exe 17 428 WScript.exe 18 428 WScript.exe 19 428 WScript.exe 24 428 WScript.exe 25 428 WScript.exe 26 428 WScript.exe 28 428 WScript.exe 29 428 WScript.exe 30 428 WScript.exe 32 428 WScript.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IwhBHZSsWd.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IwhBHZSsWd.js WScript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tullyas.txt java.exe -
Loads dropped DLL 2 IoCs
pid Process 1616 java.exe 572 java.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\IwhBHZSsWd.js\"" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\tullyas = "\"C:\\Users\\Admin\\AppData\\Roaming\\tullyas.txt\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tullyas = "\"C:\\Users\\Admin\\AppData\\Roaming\\tullyas.txt\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1916 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1192 WMIC.exe Token: SeSecurityPrivilege 1192 WMIC.exe Token: SeTakeOwnershipPrivilege 1192 WMIC.exe Token: SeLoadDriverPrivilege 1192 WMIC.exe Token: SeSystemProfilePrivilege 1192 WMIC.exe Token: SeSystemtimePrivilege 1192 WMIC.exe Token: SeProfSingleProcessPrivilege 1192 WMIC.exe Token: SeIncBasePriorityPrivilege 1192 WMIC.exe Token: SeCreatePagefilePrivilege 1192 WMIC.exe Token: SeBackupPrivilege 1192 WMIC.exe Token: SeRestorePrivilege 1192 WMIC.exe Token: SeShutdownPrivilege 1192 WMIC.exe Token: SeDebugPrivilege 1192 WMIC.exe Token: SeSystemEnvironmentPrivilege 1192 WMIC.exe Token: SeRemoteShutdownPrivilege 1192 WMIC.exe Token: SeUndockPrivilege 1192 WMIC.exe Token: SeManageVolumePrivilege 1192 WMIC.exe Token: 33 1192 WMIC.exe Token: 34 1192 WMIC.exe Token: 35 1192 WMIC.exe Token: SeIncreaseQuotaPrivilege 1192 WMIC.exe Token: SeSecurityPrivilege 1192 WMIC.exe Token: SeTakeOwnershipPrivilege 1192 WMIC.exe Token: SeLoadDriverPrivilege 1192 WMIC.exe Token: SeSystemProfilePrivilege 1192 WMIC.exe Token: SeSystemtimePrivilege 1192 WMIC.exe Token: SeProfSingleProcessPrivilege 1192 WMIC.exe Token: SeIncBasePriorityPrivilege 1192 WMIC.exe Token: SeCreatePagefilePrivilege 1192 WMIC.exe Token: SeBackupPrivilege 1192 WMIC.exe Token: SeRestorePrivilege 1192 WMIC.exe Token: SeShutdownPrivilege 1192 WMIC.exe Token: SeDebugPrivilege 1192 WMIC.exe Token: SeSystemEnvironmentPrivilege 1192 WMIC.exe Token: SeRemoteShutdownPrivilege 1192 WMIC.exe Token: SeUndockPrivilege 1192 WMIC.exe Token: SeManageVolumePrivilege 1192 WMIC.exe Token: 33 1192 WMIC.exe Token: 34 1192 WMIC.exe Token: 35 1192 WMIC.exe Token: SeIncreaseQuotaPrivilege 1684 WMIC.exe Token: SeSecurityPrivilege 1684 WMIC.exe Token: SeTakeOwnershipPrivilege 1684 WMIC.exe Token: SeLoadDriverPrivilege 1684 WMIC.exe Token: SeSystemProfilePrivilege 1684 WMIC.exe Token: SeSystemtimePrivilege 1684 WMIC.exe Token: SeProfSingleProcessPrivilege 1684 WMIC.exe Token: SeIncBasePriorityPrivilege 1684 WMIC.exe Token: SeCreatePagefilePrivilege 1684 WMIC.exe Token: SeBackupPrivilege 1684 WMIC.exe Token: SeRestorePrivilege 1684 WMIC.exe Token: SeShutdownPrivilege 1684 WMIC.exe Token: SeDebugPrivilege 1684 WMIC.exe Token: SeSystemEnvironmentPrivilege 1684 WMIC.exe Token: SeRemoteShutdownPrivilege 1684 WMIC.exe Token: SeUndockPrivilege 1684 WMIC.exe Token: SeManageVolumePrivilege 1684 WMIC.exe Token: 33 1684 WMIC.exe Token: 34 1684 WMIC.exe Token: 35 1684 WMIC.exe Token: SeIncreaseQuotaPrivilege 1684 WMIC.exe Token: SeSecurityPrivilege 1684 WMIC.exe Token: SeTakeOwnershipPrivilege 1684 WMIC.exe Token: SeLoadDriverPrivilege 1684 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1520 wrote to memory of 428 1520 wscript.exe 27 PID 1520 wrote to memory of 428 1520 wscript.exe 27 PID 1520 wrote to memory of 428 1520 wscript.exe 27 PID 1520 wrote to memory of 1404 1520 wscript.exe 28 PID 1520 wrote to memory of 1404 1520 wscript.exe 28 PID 1520 wrote to memory of 1404 1520 wscript.exe 28 PID 1404 wrote to memory of 1616 1404 Process not Found 36 PID 1404 wrote to memory of 1616 1404 Process not Found 36 PID 1404 wrote to memory of 1616 1404 Process not Found 36 PID 1616 wrote to memory of 1720 1616 java.exe 40 PID 1616 wrote to memory of 1720 1616 java.exe 40 PID 1616 wrote to memory of 1720 1616 java.exe 40 PID 1616 wrote to memory of 572 1616 java.exe 39 PID 1616 wrote to memory of 572 1616 java.exe 39 PID 1616 wrote to memory of 572 1616 java.exe 39 PID 1720 wrote to memory of 1916 1720 cmd.exe 41 PID 1720 wrote to memory of 1916 1720 cmd.exe 41 PID 1720 wrote to memory of 1916 1720 cmd.exe 41 PID 572 wrote to memory of 588 572 java.exe 43 PID 572 wrote to memory of 588 572 java.exe 43 PID 572 wrote to memory of 588 572 java.exe 43 PID 588 wrote to memory of 1192 588 cmd.exe 44 PID 588 wrote to memory of 1192 588 cmd.exe 44 PID 588 wrote to memory of 1192 588 cmd.exe 44 PID 572 wrote to memory of 952 572 java.exe 47 PID 572 wrote to memory of 952 572 java.exe 47 PID 572 wrote to memory of 952 572 java.exe 47 PID 952 wrote to memory of 1684 952 cmd.exe 45 PID 952 wrote to memory of 1684 952 cmd.exe 45 PID 952 wrote to memory of 1684 952 cmd.exe 45 PID 572 wrote to memory of 1588 572 java.exe 50 PID 572 wrote to memory of 1588 572 java.exe 50 PID 572 wrote to memory of 1588 572 java.exe 50 PID 1588 wrote to memory of 576 1588 cmd.exe 48 PID 1588 wrote to memory of 576 1588 cmd.exe 48 PID 1588 wrote to memory of 576 1588 cmd.exe 48 PID 572 wrote to memory of 1708 572 java.exe 51 PID 572 wrote to memory of 1708 572 java.exe 51 PID 572 wrote to memory of 1708 572 java.exe 51 PID 1708 wrote to memory of 1136 1708 cmd.exe 53 PID 1708 wrote to memory of 1136 1708 cmd.exe 53 PID 1708 wrote to memory of 1136 1708 cmd.exe 53
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\js-decoded-1.js1⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\IwhBHZSsWd.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:428
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\tullyas.txt"2⤵PID:1404
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\tullyas.txt"3⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\tullyas.txt"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"5⤵
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"5⤵
- Suspicious use of WriteProcessMemory
PID:952
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"5⤵
- Suspicious use of WriteProcessMemory
PID:1588
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"5⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list6⤵PID:1136
-
-
-
-
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\tullyas.txt"4⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\tullyas.txt"5⤵
- Creates scheduled task(s)
PID:1916
-
-
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list1⤵PID:576