Analysis
- max time kernel
300s - max time network
299s - platform
windows10-1703_x64 - resource
win10-20220718-en - resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system - submitted
22/07/2022, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.js
Resource
win7-20220715-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
Purchase Order.js
Resource
win10-20220718-en
windows10-1703-x64
8 signatures
300 seconds
General
- Target Purchase Order.js
- Size 36KB
- Sample220722-sb92eagbbm
- SHA256 a521bfc63365eeb8d766dc09c81c6e8a86b07ddc531abf7e8054b77a32cb9f93
- MD5 78a4c1496c7026b5cbea0fa8c10885fa
- SHA1 f5e0149e387dee861ac6cfdd1577adc2aa5b05bd
- SHA512 3ab03b53704dfc309d3eb2e7e409f25310478f2ba98a6d9a80ced0875139c0482316d4f2b6bfba05bef2c230f09a3eab572533f25f794d5a959a1cebf51264d4
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
vjw0rm
C2
-
http://franmhort.duia.ro:8154
Signatures
- suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
- suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
- Blocklisted process makes network request 64 IoCs
flow pid Process 2 2964 wscript.exe 3 2860 wscript.exe 4 2964 wscript.exe 5 2860 wscript.exe 7 2964 wscript.exe 8 2860 wscript.exe 9 2964 wscript.exe 10 2860 wscript.exe 11 2964 wscript.exe 12 2964 wscript.exe 13 2860 wscript.exe 14 2964 wscript.exe 16 2860 wscript.exe 17 2964 wscript.exe 20 2860 wscript.exe 22 2964 wscript.exe 23 2860 wscript.exe 24 2964 wscript.exe 25 2964 wscript.exe 26 2860 wscript.exe 28 2964 wscript.exe 29 2860 wscript.exe 30 2964 wscript.exe 31 2860 wscript.exe 32 2964 wscript.exe 33 2860 wscript.exe 34 2964 wscript.exe 35 2964 wscript.exe 36 2860 wscript.exe 37 2964 wscript.exe 38 2860 wscript.exe 39 2964 wscript.exe 40 2964 wscript.exe 41 2860 wscript.exe 42 2964 wscript.exe 43 2860 wscript.exe 44 2964 wscript.exe 45 2860 wscript.exe 46 2964 wscript.exe 47 2860 wscript.exe 48 2964 wscript.exe 49 2964 wscript.exe 50 2860 wscript.exe 51 2964 wscript.exe 52 2860 wscript.exe 53 2964 wscript.exe 54 2860 wscript.exe 55 2964 wscript.exe 56 2964 wscript.exe 57 2860 wscript.exe 58 2964 wscript.exe 59 2860 wscript.exe 60 2964 wscript.exe 61 2860 wscript.exe 62 2964 wscript.exe 63 2964 wscript.exe 64 2860 wscript.exe 65 2964 wscript.exe 66 2860 wscript.exe 67 2964 wscript.exe 68 2860 wscript.exe 69 2964 wscript.exe 70 2964 wscript.exe 71 2860 wscript.exe - Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hope.vbs wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hope.vbs wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mkIdhywWiI.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mkIdhywWiI.js wscript.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\Windows\CurrentVersion\Run\3LFOG3Z3XA = "\"C:\\Users\\Admin\\AppData\\Roaming\\mkIdhywWiI.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\Windows\CurrentVersion\Run\hope = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\hope.vbs\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hope = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\hope.vbs\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2860 2452 wscript.exe 66 PID 2452 wrote to memory of 2860 2452 wscript.exe 66 PID 2452 wrote to memory of 2964 2452 wscript.exe 67 PID 2452 wrote to memory of 2964 2452 wscript.exe 67
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Order.js"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\mkIdhywWiI.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2860
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\hope.vbs"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2964
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\hope.vbs
- Size 13KB
- SHA256 4d1f6bac95f39d3c780dd72b67838ec18427563edea7ba52dc25a38fda0e49cb
- MD5 5eec5455b602ca27bec10f1984be547e
- SHA1 a589e8117f8288249c82f3e3accc91af509122de
- SHA512 2cecb215a94ce517dde287d72f598a94cf726a56010347d4035310303d8375e096eb29c9dc04775eadbe0b4fa36edb811ebe59556ab2def6d0455e7fd58d6c2e
- SSDEEP 384:ozzVqiGagRYwZSFFOECXCghDSHXWmZg1r+9f7qN:ozxqagRYwZSGECXCgMmsgV/N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\mkIdhywWiI.js
- Size 5KB
- SHA256 a3f58dcd93239ce8d2674bed0036b30a91e770c549be9681344fa68f7981c9d6
- MD5 e97686cf86c86191c585166476148803
- SHA1 8de3d21dc46ea0ef2a50735afef2696ded61c5c3
- SHA512 a73e2cdb2aaa168e62f01a19ec8e5a92461284b8ce253b72dedd554e161e085b9c9bcb4f72c4c69a2e453a9bdc341790d801de2cfa4bdba792da5434a0f36166
- SSDEEP 96:05q5dF4BCtI0JgUR7Sv4JMxpzB1TLRvUO13/qsYVd0MG:05a80tIKHuzB1DOOMG
- MD5 SHA1 SHA512 SSDEEP