Analysis
-
max time kernel
151s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-06-2022 06:40
Static task
static1
Behavioral task
behavioral1
Sample
Documents.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Documents.js
Resource
win10v2004-20220414-en
General
-
Target
Documents.js
-
Size
50KB
-
MD5
256c38011ce7708a1f96f7f4d8318cea
-
SHA1
766aed3aebcf778687879eef9e4d7da4d8142360
-
SHA256
4217f9176e8f2754b10d40ead7144a9eaa1fd6a2ce038878342613ffb0f1dcfc
-
SHA512
b738c4115ac22f0f105038bc775f542621038d4cfa8226926b7f305fc31932a3f31bb3934dd127f0a574e124689a1ca9e581f2e5f82c28307eb8d4d7b77f9f31
Malware Config
Signatures
-
Blocklisted process makes network request 43 IoCs
Processes:
wscript.exewscript.exeflow pid process 6 1532 wscript.exe 7 1368 wscript.exe 8 1368 wscript.exe 9 1532 wscript.exe 12 1368 wscript.exe 13 1368 wscript.exe 15 1532 wscript.exe 17 1368 wscript.exe 18 1368 wscript.exe 20 1532 wscript.exe 22 1368 wscript.exe 23 1532 wscript.exe 25 1368 wscript.exe 26 1368 wscript.exe 28 1532 wscript.exe 29 1368 wscript.exe 31 1368 wscript.exe 32 1532 wscript.exe 34 1368 wscript.exe 36 1368 wscript.exe 38 1532 wscript.exe 39 1368 wscript.exe 41 1532 wscript.exe 42 1368 wscript.exe 44 1368 wscript.exe 46 1532 wscript.exe 47 1368 wscript.exe 48 1368 wscript.exe 50 1368 wscript.exe 52 1532 wscript.exe 53 1368 wscript.exe 54 1532 wscript.exe 56 1368 wscript.exe 58 1368 wscript.exe 59 1532 wscript.exe 61 1368 wscript.exe 62 1368 wscript.exe 65 1532 wscript.exe 66 1368 wscript.exe 67 1368 wscript.exe 68 1532 wscript.exe 70 1368 wscript.exe 72 1368 wscript.exe -
Drops startup file 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EahJBmavNO.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TTTTttttttttttestttt.vbs wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TTTTttttttttttestttt.vbs wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EahJBmavNO.js wscript.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\TTTTttttttttttestttt = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\TTTTttttttttttestttt.vbs\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TTTTttttttttttestttt = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\TTTTttttttttttestttt.vbs\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\EahJBmavNO.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 1928 wrote to memory of 1532 1928 wscript.exe wscript.exe PID 1928 wrote to memory of 1532 1928 wscript.exe wscript.exe PID 1928 wrote to memory of 1532 1928 wscript.exe wscript.exe PID 1928 wrote to memory of 1368 1928 wscript.exe wscript.exe PID 1928 wrote to memory of 1368 1928 wscript.exe wscript.exe PID 1928 wrote to memory of 1368 1928 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Documents.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\EahJBmavNO.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\TTTTttttttttttestttt.vbs"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TTTTttttttttttestttt.vbsFilesize
13KB
MD5ddb4cbf2022f72131c17307ad516de5d
SHA17a600bcb884444efcc5c9f4f9b63c6b89c9367b8
SHA256c19033f4a897abe7fba27db9daf125f31ff9317da5faec56c24a054b55f4bfc5
SHA51263fb993d5068c0ffbdcb75e7bc4a413b213657eae6fa40ddf2f47c42916e6133f1ab8ee11ea46220b211c819ac450a6da1a26a1fa1904083df1d8ad976e052a6
-
C:\Users\Admin\AppData\Roaming\EahJBmavNO.jsFilesize
10KB
MD53a19cd2d04b6ade45a7d5e7b5c9d2708
SHA1091400b8f5f1acdd5172a33ff737496a63ea0ac1
SHA2562fcd2ccf95c78cd83c8dbbb396aacfa7ec0287828cf34797b0935656fc9bf2a6
SHA51280061f3114eb1254c49c0dbd508b0e711025778ba2a4ba00e40eba66f6ddab199420cd891734b61b03911baa9f374f7f4f4227fa5d7c6ff0216294a7c721b813
-
memory/1368-56-0x0000000000000000-mapping.dmp
-
memory/1532-55-0x0000000000000000-mapping.dmp
-
memory/1928-54-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmpFilesize
8KB