Analysis
-
max time kernel
4294209s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
12-03-2022 08:49
Static task
static1
Behavioral task
behavioral1
Sample
efcdeefba79358f7c7fe176e3efb65513b34c5c4f4e0f12192dfb544149105ba.js
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
efcdeefba79358f7c7fe176e3efb65513b34c5c4f4e0f12192dfb544149105ba.js
Resource
win10v2004-en-20220113
General
-
Target
efcdeefba79358f7c7fe176e3efb65513b34c5c4f4e0f12192dfb544149105ba.js
-
Size
66KB
-
MD5
42d55b6f9eca214d8322f6f8d3fd97fa
-
SHA1
bba7f2f09e21e94170771276bb543056a9fafa15
-
SHA256
efcdeefba79358f7c7fe176e3efb65513b34c5c4f4e0f12192dfb544149105ba
-
SHA512
7376cfa00a4bece9614c98ccbc0bccf2de0f7949564d5ec219338871c1dbf27a930383e10b11e709df467ee6512c658830106de2861b6ab8319c2db4ff5601bd
Malware Config
Extracted
vjw0rm
http://zeegod.duckdns.org:9998
Signatures
-
Blocklisted process makes network request 19 IoCs
Processes:
wscript.exewscript.exeflow pid process 8 1832 wscript.exe 9 1448 wscript.exe 10 1448 wscript.exe 12 1448 wscript.exe 15 1448 wscript.exe 17 1448 wscript.exe 18 1448 wscript.exe 21 1448 wscript.exe 23 1448 wscript.exe 24 1448 wscript.exe 27 1448 wscript.exe 29 1448 wscript.exe 31 1448 wscript.exe 33 1448 wscript.exe 35 1448 wscript.exe 37 1448 wscript.exe 40 1448 wscript.exe 41 1448 wscript.exe 43 1448 wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PjAkivHuis.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\efcdeefba79358f7c7fe176e3efb65513b34c5c4f4e0f12192dfb544149105ba.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PjAkivHuis.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\00FAYTSXGU = "\"C:\\Users\\Admin\\AppData\\Roaming\\PjAkivHuis.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\YSAGQWKNY8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\efcdeefba79358f7c7fe176e3efb65513b34c5c4f4e0f12192dfb544149105ba.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 1832 wrote to memory of 1448 1832 wscript.exe wscript.exe PID 1832 wrote to memory of 1448 1832 wscript.exe wscript.exe PID 1832 wrote to memory of 1448 1832 wscript.exe wscript.exe PID 1832 wrote to memory of 760 1832 wscript.exe schtasks.exe PID 1832 wrote to memory of 760 1832 wscript.exe schtasks.exe PID 1832 wrote to memory of 760 1832 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\efcdeefba79358f7c7fe176e3efb65513b34c5c4f4e0f12192dfb544149105ba.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PjAkivHuis.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1448 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\efcdeefba79358f7c7fe176e3efb65513b34c5c4f4e0f12192dfb544149105ba.js2⤵
- Creates scheduled task(s)
PID:760
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\PjAkivHuis.jsMD5
458502e2563a658624c8f0b366f01c95
SHA1c09a86d6381df9613689315119c7cf3441a7ce40
SHA256c4cf9fe07191cfafef4b722962c990f8949cb98acebbc5f4b60fc871593d21e6
SHA512f69688610175e30302c3a20787259ee1badc24325230cea98f7dacfe83a624af8ca3e421d0007ef17a42f99f529a290eb596d5f191088b7046948169b69f8323
-
memory/1832-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmpFilesize
8KB