Analysis
- max time kernel
297s - max time network
304s - platform
windows7_x64 - resource
win7-20220715-en - resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system - submitted
22/07/2022, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.js
Resource
win7-20220715-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
Purchase Order.js
Resource
win10-20220718-en
windows10-1703-x64
8 signatures
300 seconds
General
- Target Purchase Order.js
- Size 36KB
- Sample220722-sb92eagbbm
- SHA256 a521bfc63365eeb8d766dc09c81c6e8a86b07ddc531abf7e8054b77a32cb9f93
- MD5 78a4c1496c7026b5cbea0fa8c10885fa
- SHA1 f5e0149e387dee861ac6cfdd1577adc2aa5b05bd
- SHA512 3ab03b53704dfc309d3eb2e7e409f25310478f2ba98a6d9a80ced0875139c0482316d4f2b6bfba05bef2c230f09a3eab572533f25f794d5a959a1cebf51264d4
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
vjw0rm
C2
-
http://franmhort.duia.ro:8154
Signatures
- suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
- suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
- Blocklisted process makes network request 64 IoCs
flow pid Process 6 1952 wscript.exe 7 2024 wscript.exe 8 2024 wscript.exe 10 1952 wscript.exe 11 2024 wscript.exe 14 1952 wscript.exe 16 2024 wscript.exe 17 1952 wscript.exe 19 2024 wscript.exe 20 2024 wscript.exe 22 1952 wscript.exe 25 2024 wscript.exe 27 1952 wscript.exe 29 2024 wscript.exe 30 2024 wscript.exe 32 1952 wscript.exe 34 2024 wscript.exe 35 1952 wscript.exe 37 2024 wscript.exe 38 2024 wscript.exe 40 1952 wscript.exe 43 2024 wscript.exe 45 1952 wscript.exe 46 2024 wscript.exe 47 2024 wscript.exe 48 1952 wscript.exe 51 2024 wscript.exe 53 1952 wscript.exe 55 2024 wscript.exe 57 1952 wscript.exe 58 2024 wscript.exe 60 2024 wscript.exe 62 1952 wscript.exe 63 2024 wscript.exe 65 1952 wscript.exe 67 2024 wscript.exe 69 2024 wscript.exe 70 1952 wscript.exe 72 2024 wscript.exe 73 1952 wscript.exe 75 2024 wscript.exe 77 2024 wscript.exe 78 1952 wscript.exe 81 2024 wscript.exe 83 1952 wscript.exe 84 2024 wscript.exe 86 2024 wscript.exe 88 1952 wscript.exe 89 2024 wscript.exe 91 1952 wscript.exe 93 2024 wscript.exe 96 1952 wscript.exe 97 2024 wscript.exe 98 2024 wscript.exe 100 1952 wscript.exe 101 2024 wscript.exe 104 1952 wscript.exe 106 2024 wscript.exe 107 2024 wscript.exe 109 1952 wscript.exe 110 2024 wscript.exe 112 1952 wscript.exe 114 2024 wscript.exe 115 2024 wscript.exe - Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hope.vbs wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hope.vbs wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mkIdhywWiI.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mkIdhywWiI.js wscript.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hope = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\hope.vbs\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\3LFOG3Z3XA = "\"C:\\Users\\Admin\\AppData\\Roaming\\mkIdhywWiI.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\hope = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\hope.vbs\"" wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 668 wrote to memory of 1952 668 wscript.exe 27 PID 668 wrote to memory of 1952 668 wscript.exe 27 PID 668 wrote to memory of 1952 668 wscript.exe 27 PID 668 wrote to memory of 2024 668 wscript.exe 28 PID 668 wrote to memory of 2024 668 wscript.exe 28 PID 668 wrote to memory of 2024 668 wscript.exe 28
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Order.js"1⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\mkIdhywWiI.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1952
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\hope.vbs"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2024
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\hope.vbs
- Size 13KB
- SHA256 4d1f6bac95f39d3c780dd72b67838ec18427563edea7ba52dc25a38fda0e49cb
- MD5 5eec5455b602ca27bec10f1984be547e
- SHA1 a589e8117f8288249c82f3e3accc91af509122de
- SHA512 2cecb215a94ce517dde287d72f598a94cf726a56010347d4035310303d8375e096eb29c9dc04775eadbe0b4fa36edb811ebe59556ab2def6d0455e7fd58d6c2e
- SSDEEP 384:ozzVqiGagRYwZSFFOECXCghDSHXWmZg1r+9f7qN:ozxqagRYwZSGECXCgMmsgV/N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\mkIdhywWiI.js
- Size 5KB
- SHA256 a3f58dcd93239ce8d2674bed0036b30a91e770c549be9681344fa68f7981c9d6
- MD5 e97686cf86c86191c585166476148803
- SHA1 8de3d21dc46ea0ef2a50735afef2696ded61c5c3
- SHA512 a73e2cdb2aaa168e62f01a19ec8e5a92461284b8ce253b72dedd554e161e085b9c9bcb4f72c4c69a2e453a9bdc341790d801de2cfa4bdba792da5434a0f36166
- SSDEEP 96:05q5dF4BCtI0JgUR7Sv4JMxpzB1TLRvUO13/qsYVd0MG:05a80tIKHuzB1DOOMG
- MD5 SHA1 SHA512 SSDEEP