Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-12-2021 09:38
Static task
static1
Behavioral task
behavioral1
Sample
bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js
Resource
win10-en-20211208
General
-
Target
bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js
-
Size
209KB
-
MD5
e6860fcf7fd568970643d88ddc7d87cd
-
SHA1
fef07c35b5cb90b850f920b222b7cf005c03b199
-
SHA256
bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b
-
SHA512
85d9eb5e92a593de8c170a92f1d7d67fdb5ca4bc57b0a865a4a81d626873ae316514293eb77730b0d1a11136c4696adb413f5c071a227aed9f00e048a9b18f8b
Malware Config
Signatures
-
Blocklisted process makes network request 37 IoCs
Processes:
wscript.exewscript.exeflow pid process 10 3668 wscript.exe 11 1944 wscript.exe 22 1944 wscript.exe 23 3668 wscript.exe 28 1944 wscript.exe 29 3668 wscript.exe 30 1944 wscript.exe 31 3668 wscript.exe 32 1944 wscript.exe 33 3668 wscript.exe 34 1944 wscript.exe 35 3668 wscript.exe 36 1944 wscript.exe 37 3668 wscript.exe 38 1944 wscript.exe 39 3668 wscript.exe 42 1944 wscript.exe 43 3668 wscript.exe 44 1944 wscript.exe 45 3668 wscript.exe 46 1944 wscript.exe 47 3668 wscript.exe 48 1944 wscript.exe 49 3668 wscript.exe 50 1944 wscript.exe 51 3668 wscript.exe 52 1944 wscript.exe 53 3668 wscript.exe 54 1944 wscript.exe 55 3668 wscript.exe 56 1944 wscript.exe 57 3668 wscript.exe 58 1944 wscript.exe 59 3668 wscript.exe 60 1944 wscript.exe 61 3668 wscript.exe 62 1944 wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\beVSdOTIld.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\beVSdOTIld.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\G1LWDBN6QR = "\"C:\\Users\\Admin\\AppData\\Roaming\\bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\beVSdOTIld.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.exedescription pid process target process PID 3668 wrote to memory of 1944 3668 wscript.exe wscript.exe PID 3668 wrote to memory of 1944 3668 wscript.exe wscript.exe PID 3668 wrote to memory of 4328 3668 wscript.exe schtasks.exe PID 3668 wrote to memory of 4328 3668 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\beVSdOTIld.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1944 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b.js2⤵
- Creates scheduled task(s)
PID:4328
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\beVSdOTIld.jsMD5
5a6b6b58ecb6d0c0aac457c6bbbe1b8c
SHA1f84d217b7404cde7be72d77baa6a68621418d4dd
SHA256bd34475e672c363420200ca5f8b2c477496bb42d2d1901a8a95c406f05f489de
SHA5123757be1d0034de1ad63b079a5db0a7918f140a01aaca3748fe51fbd27818171894fde74f117e597afeda7a42b448d6f4642f5bb1716aea6efa95cda57a36dc6c
-
memory/1944-115-0x0000000000000000-mapping.dmp
-
memory/4328-117-0x0000000000000000-mapping.dmp