Analysis
- max time kernel
549s - max time network
556s - platform
windows7_x64 - resource
win7-20220414-en - submitted
13/06/2022, 03:29
Static task
static1
Behavioral task
behavioral1
Sample
NEW-PO.js
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
NEW-PO.js
Resource
win10-20220414-en
windows10_x64
0 signatures
0 seconds
General
- Target NEW-PO.js
- Size 100KB
- Sample220613-d169gsdeen
- SHA256 9446c38b335edc7d0dbfa754ad0a8f1a41de185f83722b43816b739c3ceb74f4
- MD5 485e3fa1027dc300cbcf48fea637dd57
- SHA1 589ff4d6aae5af14bc251db32ec6e239f63dcdc5
- SHA512 257b334e96bc4dc1fcd184e5d77f97bec8fffec3f76b4b8038c9f8b148a4e400dcfe2c7907720863cd3dc160ef048db3ef224646db5b27b3b4f98113c067e888
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
vjw0rm
C2
-
http://franmhort.duia.ro:8152
Signatures
- suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
- suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
- Blocklisted process makes network request 60 IoCs
flow pid Process 6 620 wscript.exe 7 524 wscript.exe 8 620 wscript.exe 9 620 wscript.exe 13 620 wscript.exe 14 620 wscript.exe 15 620 wscript.exe 17 620 wscript.exe 18 620 wscript.exe 19 620 wscript.exe 21 620 wscript.exe 22 620 wscript.exe 24 620 wscript.exe 26 620 wscript.exe 27 620 wscript.exe 28 620 wscript.exe 30 620 wscript.exe 31 620 wscript.exe 32 620 wscript.exe 34 620 wscript.exe 35 620 wscript.exe 36 620 wscript.exe 38 620 wscript.exe 39 620 wscript.exe 40 620 wscript.exe 42 620 wscript.exe 43 620 wscript.exe 44 620 wscript.exe 46 620 wscript.exe 47 620 wscript.exe 48 620 wscript.exe 50 620 wscript.exe 51 620 wscript.exe 52 620 wscript.exe 54 620 wscript.exe 55 620 wscript.exe 56 620 wscript.exe 58 620 wscript.exe 59 620 wscript.exe 60 620 wscript.exe 62 620 wscript.exe 63 620 wscript.exe 64 620 wscript.exe 66 620 wscript.exe 67 620 wscript.exe 68 620 wscript.exe 70 620 wscript.exe 71 620 wscript.exe 72 620 wscript.exe 74 620 wscript.exe 75 620 wscript.exe 76 620 wscript.exe 78 620 wscript.exe 79 620 wscript.exe 80 620 wscript.exe 82 620 wscript.exe 83 620 wscript.exe 84 620 wscript.exe 86 620 wscript.exe 87 620 wscript.exe - Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hworm.vbs wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hworm.vbs wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gQZvgHUtLG.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gQZvgHUtLG.js wscript.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\hworm = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hworm.vbs\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hworm = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hworm.vbs\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\gQZvgHUtLG.js\"" wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1688 wrote to memory of 620 1688 wscript.exe 27 PID 1688 wrote to memory of 620 1688 wscript.exe 27 PID 1688 wrote to memory of 620 1688 wscript.exe 27 PID 1688 wrote to memory of 524 1688 wscript.exe 28 PID 1688 wrote to memory of 524 1688 wscript.exe 28 PID 1688 wrote to memory of 524 1688 wscript.exe 28
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\NEW-PO.js1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\gQZvgHUtLG.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:620
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\hworm.vbs"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:524
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\hworm.vbs
- Size 13KB
- SHA256 185182f369edcb96118a91dcad39eb5b63239112ed6963a8c274178bf1b55394
- MD5 4b685bd75281e7d4fd5d5c6ea517f7b4
- SHA1 737c0d37815c7c22b036c1edba100a95a67ae671
- SHA512 dec575589bc3fb8ba72fd7e7d83f20baad4d3fef7da54fe9203444c0c4a8ac39f1608c11a1427071b8af9554067bdd24810beeca8d924b6df871bfd9d1687487
- SSDEEP 384:IzzVqiGagRYwZSFFOECXCghDSHXWmZg1r+9f7qN:IzxqagRYwZSGECXCgMmsgV/N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\gQZvgHUtLG.js
- Size 27KB
- SHA256 3fcc843e8735f172c8746f473f042cc7bf796cad0b25f4d2e210251e206f9b43
- MD5 d0180262c99e4a8b9bcae252950d3b53
- SHA1 6039d0a418ea7afdb2d64c7621107510459d970a
- SHA512 fbe38862a7cefd617033f65ea91b889b49245e9643ba35ebd4123f31e1236dc0f3cea0aca8e828534e48c62554de0f69b8a1733bfceb3c411f93f96ad2f59581
- SSDEEP 384:8OpsLGdKCVFD4Wg7YJ66fcVE6aE6jXHO0edbvfTu4Gurb0:UvCVtpV66Knq0dbvf64GuP0
- MD5 SHA1 SHA512 SSDEEP