Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2022, 15:31
Static task
static1
Behavioral task
behavioral1
Sample
bZQEUbJxNj.js
Resource
win7-20220812-en
4 signatures
150 seconds
General
-
Target
bZQEUbJxNj.js
-
Size
6KB
-
MD5
a542a21ecaba36f6ba8c6457b8ab67f9
-
SHA1
3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c
-
SHA256
bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b
-
SHA512
78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a
Malware Config
Signatures
-
Blocklisted process makes network request 16 IoCs
flow pid Process 12 5020 wscript.exe 14 5020 wscript.exe 15 5020 wscript.exe 24 5020 wscript.exe 28 5020 wscript.exe 29 5020 wscript.exe 30 5020 wscript.exe 34 5020 wscript.exe 35 5020 wscript.exe 36 5020 wscript.exe 38 5020 wscript.exe 39 5020 wscript.exe 40 5020 wscript.exe 41 5020 wscript.exe 42 5020 wscript.exe 43 5020 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.