Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2022, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
New Order.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
New Order.js
Resource
win10v2004-20220812-en
General
-
Target
New Order.js
-
Size
12KB
-
MD5
708bb09719cadbf4955924c22f8bc32f
-
SHA1
03fa57e6a7f07b08e4aa5a2f1f5cc5250b7793f2
-
SHA256
53bbab870aa1d49a4e311a68a163692115d59e4c2fd5493abca783dbf55f45f9
-
SHA512
392089bb77788e8825ec58c5f3cf480cdfd76495417580cbddbc6ef87ea6a7a4716fd40302f84d916fd1ccab2d0b9a60c3749c33cf799c50558fe19d9b7ab233
Malware Config
Signatures
-
Blocklisted process makes network request 12 IoCs
flow pid Process 5 3904 wscript.exe 15 3904 wscript.exe 19 3904 wscript.exe 20 3904 wscript.exe 30 3904 wscript.exe 32 3904 wscript.exe 34 3904 wscript.exe 35 3904 wscript.exe 36 3904 wscript.exe 37 3904 wscript.exe 38 3904 wscript.exe 39 3904 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New Order.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GR52XVJZ4Q = "\"C:\\Users\\Admin\\AppData\\Roaming\\New Order.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3404 schtasks.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3904 wrote to memory of 3424 3904 wscript.exe 81 PID 3904 wrote to memory of 3424 3904 wscript.exe 81 PID 3904 wrote to memory of 3404 3904 wscript.exe 82 PID 3904 wrote to memory of 3404 3904 wscript.exe 82
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\New Order.js"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\HVcGjHlAjW.js"2⤵PID:3424
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\New Order.js2⤵
- Creates scheduled task(s)
PID:3404
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fbaec096e2d7b0f56c7abdb5f171e8b3
SHA12c26f08b135fa9f04e1fbc3c93dbf4df0b17cb66
SHA2561f8ce58992df786114e0d5a23ff54bf867391bdabafb720776c3d8871fd8a0b5
SHA51267537a2e7fd94686d0320e5a0dcd0e0214de08f4f4c3ab4c34c969e2a6d9123fec6c08206d5ba07b511e1acd23f464106e9daa21248407a7a5dc1cd69de49b27