Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2022, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
bZQEUbJxNj.js
Resource
win7-20220812-en
4 signatures
150 seconds
General
-
Target
bZQEUbJxNj.js
-
Size
6KB
-
MD5
a542a21ecaba36f6ba8c6457b8ab67f9
-
SHA1
3f05ddc6d6e59554cd9870b9e4b17919b81eaa6c
-
SHA256
bc831f27e6da7b5e82be628a1564c8b6aee02ec9290c5d21f99733dd2d1db47b
-
SHA512
78ca13a83bbd029470978b1e465ee6b0c2a9345a1fe8ee3e86d9f1d48bd52b7927a16e607f71084a91706213d8ddc0293ed06a1927e478b9bbc21ab0b47b9a2a
Malware Config
Extracted
Family
vjw0rm
C2
http://macjoe597.duia.ro:8159
Signatures
-
Blocklisted process makes network request 21 IoCs
flow pid Process 8 2060 wscript.exe 9 2060 wscript.exe 10 2060 wscript.exe 12 2060 wscript.exe 23 2060 wscript.exe 24 2060 wscript.exe 26 2060 wscript.exe 32 2060 wscript.exe 33 2060 wscript.exe 39 2060 wscript.exe 40 2060 wscript.exe 41 2060 wscript.exe 42 2060 wscript.exe 45 2060 wscript.exe 46 2060 wscript.exe 47 2060 wscript.exe 48 2060 wscript.exe 49 2060 wscript.exe 50 2060 wscript.exe 51 2060 wscript.exe 52 2060 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bZQEUbJxNj.js wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.