Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
29-12-2021 09:38
Static task
static1
Behavioral task
behavioral1
Sample
bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js
Resource
win10-en-20211208
General
-
Target
bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js
-
Size
209KB
-
MD5
e6860fcf7fd568970643d88ddc7d87cd
-
SHA1
fef07c35b5cb90b850f920b222b7cf005c03b199
-
SHA256
bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b
-
SHA512
85d9eb5e92a593de8c170a92f1d7d67fdb5ca4bc57b0a865a4a81d626873ae316514293eb77730b0d1a11136c4696adb413f5c071a227aed9f00e048a9b18f8b
Malware Config
Signatures
-
Blocklisted process makes network request 36 IoCs
Processes:
wscript.exewscript.exeflow pid process 8 1912 wscript.exe 9 784 wscript.exe 10 784 wscript.exe 12 1912 wscript.exe 14 784 wscript.exe 15 1912 wscript.exe 18 784 wscript.exe 20 1912 wscript.exe 22 784 wscript.exe 23 1912 wscript.exe 24 784 wscript.exe 27 1912 wscript.exe 29 784 wscript.exe 31 1912 wscript.exe 32 784 wscript.exe 34 1912 wscript.exe 35 784 wscript.exe 38 1912 wscript.exe 40 784 wscript.exe 42 1912 wscript.exe 44 784 wscript.exe 45 1912 wscript.exe 46 784 wscript.exe 49 1912 wscript.exe 51 784 wscript.exe 53 1912 wscript.exe 54 784 wscript.exe 56 1912 wscript.exe 58 784 wscript.exe 60 1912 wscript.exe 62 784 wscript.exe 64 1912 wscript.exe 66 784 wscript.exe 67 1912 wscript.exe 69 784 wscript.exe 71 1912 wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\beVSdOTIld.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\beVSdOTIld.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\beVSdOTIld.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\G1LWDBN6QR = "\"C:\\Users\\Admin\\AppData\\Roaming\\bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 1912 wrote to memory of 784 1912 wscript.exe wscript.exe PID 1912 wrote to memory of 784 1912 wscript.exe wscript.exe PID 1912 wrote to memory of 784 1912 wscript.exe wscript.exe PID 1912 wrote to memory of 864 1912 wscript.exe schtasks.exe PID 1912 wrote to memory of 864 1912 wscript.exe schtasks.exe PID 1912 wrote to memory of 864 1912 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\beVSdOTIld.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\beVSdOTIld.jsMD5
5a6b6b58ecb6d0c0aac457c6bbbe1b8c
SHA1f84d217b7404cde7be72d77baa6a68621418d4dd
SHA256bd34475e672c363420200ca5f8b2c477496bb42d2d1901a8a95c406f05f489de
SHA5123757be1d0034de1ad63b079a5db0a7918f140a01aaca3748fe51fbd27818171894fde74f117e597afeda7a42b448d6f4642f5bb1716aea6efa95cda57a36dc6c
-
memory/784-55-0x0000000000000000-mapping.dmp
-
memory/864-57-0x0000000000000000-mapping.dmp
-
memory/1912-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmpFilesize
8KB