Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17/08/2022, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
bZQEUbJxNj.js
Resource
win7-20220812-en
4 signatures
150 seconds
General
-
Target
bZQEUbJxNj.js
-
Size
6KB
-
MD5
a542a21ecaba36f6ba8c6457b8ab67f9
-
SHA1
3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c
-
SHA256
bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b
-
SHA512
78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a
Malware Config
Extracted
Family
vjw0rm
C2
http://macjoe597.duia.ro:8159
Signatures
-
Blocklisted process makes network request 19 IoCs
flow pid Process 4 1020 wscript.exe 5 1020 wscript.exe 6 1020 wscript.exe 7 1020 wscript.exe 8 1020 wscript.exe 10 1020 wscript.exe 11 1020 wscript.exe 12 1020 wscript.exe 13 1020 wscript.exe 14 1020 wscript.exe 15 1020 wscript.exe 16 1020 wscript.exe 17 1020 wscript.exe 18 1020 wscript.exe 19 1020 wscript.exe 20 1020 wscript.exe 21 1020 wscript.exe 22 1020 wscript.exe 23 1020 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.