Analysis
-
max time kernel
144s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-06-2022 08:15
Static task
static1
Behavioral task
behavioral1
Sample
MgBMOjoQWC_hwstub.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
MgBMOjoQWC_hwstub.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
bJHtVihBXX_acserver.js
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
bJHtVihBXX_acserver.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
sYCuOOjDOl_vjstub.js
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
sYCuOOjDOl_vjstub.js
Resource
win10v2004-20220414-en
General
-
Target
MgBMOjoQWC_hwstub.js
-
Size
51KB
-
MD5
0c7657296a9994e6446ff500bc1b76c3
-
SHA1
bfdc4584c89faa7f3356549494331ccc8497ab33
-
SHA256
692a8be00d69e5d0782766f270046aa871fea041e63d125da9e1252b135623f3
-
SHA512
8549c221d3316d3a57feb5c4bdca51ae504f5479e22b83150a9eca82fb0b5f8ef8b2aa134d2b96c5bef42a170cc7c4dc8099606f71fabcd490732f7b8926213d
Malware Config
Signatures
-
Blocklisted process makes network request 16 IoCs
Processes:
wscript.exewscript.exeflow pid process 4 2100 wscript.exe 5 1280 wscript.exe 10 1280 wscript.exe 12 1280 wscript.exe 13 2100 wscript.exe 30 2100 wscript.exe 31 1280 wscript.exe 32 1280 wscript.exe 39 1280 wscript.exe 40 2100 wscript.exe 47 1280 wscript.exe 50 2100 wscript.exe 51 1280 wscript.exe 57 1280 wscript.exe 58 2100 wscript.exe 59 1280 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hwo1.vbs wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hwo1.vbs wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xkJOOSCzhz.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xkJOOSCzhz.js wscript.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hwo1 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\hwo1.vbs\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\xkJOOSCzhz.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hwo1 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\hwo1.vbs\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.exedescription pid process target process PID 4640 wrote to memory of 1280 4640 wscript.exe wscript.exe PID 4640 wrote to memory of 1280 4640 wscript.exe wscript.exe PID 4640 wrote to memory of 2100 4640 wscript.exe wscript.exe PID 4640 wrote to memory of 2100 4640 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\MgBMOjoQWC_hwstub.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xkJOOSCzhz.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1280
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\hwo1.vbs"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2100
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD50fa22927ed90ae0bfbc0fbc979d566ff
SHA1c6562835566afe7eded525f68a0cfdf6f82b4a0a
SHA2569ec1848a60e25d9bf6f2d3dd2e607e269a259925b143ea20ee7dfbe58f7152e7
SHA5128692696d841a50b811e21384ee040cbeb478cfe5a2f093ed7b6d1869ae910c590ad940771d9f95a76880f4c25d637d4f29fbe14e2c16b6a424e54a48812b7203
-
Filesize
10KB
MD5dffdb0fc6b534c658575b72bfd4826ae
SHA1d6cc3039c628b6d9e8a137933fa953e785a9ef0b
SHA2567e4297ebdde73b716fafb213529d79007e6825b786a471ca7e5a52024fddb939
SHA512c9f4be68cc09ad027a65745233363940ed7ee7b82ecf919096336ddfec90932ad707ec30089e40f8e2918df2b14f400c96d3d854c0d89ae56897e06e849637ae