Analysis
-
max time kernel
4294212s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
17-03-2022 07:16
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.js
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ.js
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
RFQ.js
-
Size
3KB
-
MD5
f68bfaf10007b75b933c2a2acab4d54c
-
SHA1
7cabe5b37ea9d22450e80d41378c5e8eefa7eea5
-
SHA256
a89127ec0c19df41166916cfa4c199d97eade3ec4f0cf4d2281408cfe2790c2a
-
SHA512
7ea74f93293e6171338e896243e2ecb696c6b4fbd7cfeffba6e0312a4b8c3789a949e9a0e4e8a566f946d36ebaad59d8477fcaf7681e91b9cc399ff865219a8d
Score
10/10
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
wscript.exeflow pid process 4 1560 wscript.exe 5 1560 wscript.exe 6 1560 wscript.exe 7 1560 wscript.exe 8 1560 wscript.exe 9 1560 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run\U1FBR8C2J2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RFQ.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1560 wrote to memory of 1648 1560 wscript.exe schtasks.exe PID 1560 wrote to memory of 1648 1560 wscript.exe schtasks.exe PID 1560 wrote to memory of 1648 1560 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\RFQ.js2⤵
- Creates scheduled task(s)
PID:1648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1560-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmpFilesize
8KB