Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
04-01-2022 04:16
Static task
static1
Behavioral task
behavioral1
Sample
d0bbf57aae4d2807dce2ec9dff881b5ece9dcd236ab9753aefafdf67cc57e9b2.iso
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d0bbf57aae4d2807dce2ec9dff881b5ece9dcd236ab9753aefafdf67cc57e9b2.iso
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
image006.png.js
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
image006.png.js
Resource
win10-en-20211208
General
-
Target
image006.png.js
-
Size
209KB
-
MD5
e6860fcf7fd568970643d88ddc7d87cd
-
SHA1
fef07c35b5cb90b850f920b222b7cf005c03b199
-
SHA256
bae95e206861f753435369c3ca6b6c4bc655bd8a6f461c150785b1899766d55b
-
SHA512
85d9eb5e92a593de8c170a92f1d7d67fdb5ca4bc57b0a865a4a81d626873ae316514293eb77730b0d1a11136c4696adb413f5c071a227aed9f00e048a9b18f8b
Malware Config
Extracted
vjw0rm
http://spdxx.ddns.net:5050
Signatures
-
Blocklisted process makes network request 19 IoCs
Processes:
wscript.exewscript.exeflow pid process 8 1884 wscript.exe 9 696 wscript.exe 10 696 wscript.exe 13 696 wscript.exe 15 696 wscript.exe 18 696 wscript.exe 20 696 wscript.exe 22 696 wscript.exe 25 696 wscript.exe 27 696 wscript.exe 29 696 wscript.exe 32 696 wscript.exe 33 696 wscript.exe 37 696 wscript.exe 39 696 wscript.exe 40 696 wscript.exe 44 696 wscript.exe 46 696 wscript.exe 48 696 wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\beVSdOTIld.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\beVSdOTIld.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\image006.png.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\G1LWDBN6QR = "\"C:\\Users\\Admin\\AppData\\Roaming\\image006.png.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\beVSdOTIld.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 1884 wrote to memory of 696 1884 wscript.exe wscript.exe PID 1884 wrote to memory of 696 1884 wscript.exe wscript.exe PID 1884 wrote to memory of 696 1884 wscript.exe wscript.exe PID 1884 wrote to memory of 336 1884 wscript.exe schtasks.exe PID 1884 wrote to memory of 336 1884 wscript.exe schtasks.exe PID 1884 wrote to memory of 336 1884 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\image006.png.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\beVSdOTIld.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:696 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\image006.png.js2⤵
- Creates scheduled task(s)
PID:336
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\beVSdOTIld.jsMD5
5a6b6b58ecb6d0c0aac457c6bbbe1b8c
SHA1f84d217b7404cde7be72d77baa6a68621418d4dd
SHA256bd34475e672c363420200ca5f8b2c477496bb42d2d1901a8a95c406f05f489de
SHA5123757be1d0034de1ad63b079a5db0a7918f140a01aaca3748fe51fbd27818171894fde74f117e597afeda7a42b448d6f4642f5bb1716aea6efa95cda57a36dc6c
-
memory/336-56-0x0000000000000000-mapping.dmp
-
memory/696-54-0x0000000000000000-mapping.dmp
-
memory/1884-53-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmpFilesize
8KB