Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17/08/2022, 15:31
Static task
static1
Behavioral task
behavioral1
Sample
bZQEUbJxNj.js
Resource
win7-20220812-en
4 signatures
150 seconds
General
-
Target
bZQEUbJxNj.js
-
Size
6KB
-
MD5
a542a21ecaba36f6ba8c6457b8ab67f9
-
SHA1
3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c
-
SHA256
bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b
-
SHA512
78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a
Malware Config
Signatures
-
Blocklisted process makes network request 16 IoCs
flow pid Process 4 1280 wscript.exe 5 1280 wscript.exe 6 1280 wscript.exe 8 1280 wscript.exe 10 1280 wscript.exe 11 1280 wscript.exe 13 1280 wscript.exe 14 1280 wscript.exe 15 1280 wscript.exe 17 1280 wscript.exe 18 1280 wscript.exe 19 1280 wscript.exe 21 1280 wscript.exe 22 1280 wscript.exe 23 1280 wscript.exe 25 1280 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.