Analysis
-
max time kernel
26s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-08-2022 15:53
Static task
static1
Behavioral task
behavioral1
Sample
Request Quote_PDF.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Request Quote_PDF.js
Resource
win10v2004-20220812-en
General
-
Target
Request Quote_PDF.js
-
Size
427KB
-
MD5
e28f128487db3254400a7544bb4b679b
-
SHA1
e28482717d27cd0b4f396d6df4d701a973b6d357
-
SHA256
3788a03e4c4f4ceb8ef566ea2659ebe141fc679b97f4a1fda3f4a4f52541adc2
-
SHA512
233bbade78b41008faef8a6429eff67275723cb8211da050088f98c364ec798cddc792d2fa6dd70dfc6b6c98f183e6dd80bb7ef3c1b59c07608bd329d5c2bcac
-
SSDEEP
6144:1aAy6ubR3WGWMkndfTZFTu11LcNbu/RiJITRx5D5P1O8k8+gVelAkD9:1avdcTZFTuPINbcTRvD9W7ge
Malware Config
Signatures
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe netwire C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe netwire \Users\Admin\AppData\Roaming\Googlee\Notepad.exe netwire \Users\Admin\AppData\Roaming\Googlee\Notepad.exe netwire C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe netwire C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe netwire \Users\Admin\AppData\Roaming\Googlee\Notepad.exe netwire -
Executes dropped EXE 2 IoCs
Processes:
Host Ip Js StartUp.exeNotepad.exepid process 1716 Host Ip Js StartUp.exe 880 Notepad.exe -
Drops startup file 1 IoCs
Processes:
Notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Note.lnk Notepad.exe -
Loads dropped DLL 3 IoCs
Processes:
Host Ip Js StartUp.exeNotepad.exepid process 1716 Host Ip Js StartUp.exe 1716 Host Ip Js StartUp.exe 880 Notepad.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Notepad.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\£2ëUíaÊ—KåL¦K®¨æ = "C:\\Users\\Admin\\AppData\\Roaming\\Googlee\\Notepad.exe" Notepad.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Notepad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
wscript.exeHost Ip Js StartUp.exedescription pid process target process PID 1684 wrote to memory of 1360 1684 wscript.exe wscript.exe PID 1684 wrote to memory of 1360 1684 wscript.exe wscript.exe PID 1684 wrote to memory of 1360 1684 wscript.exe wscript.exe PID 1684 wrote to memory of 1716 1684 wscript.exe Host Ip Js StartUp.exe PID 1684 wrote to memory of 1716 1684 wscript.exe Host Ip Js StartUp.exe PID 1684 wrote to memory of 1716 1684 wscript.exe Host Ip Js StartUp.exe PID 1684 wrote to memory of 1716 1684 wscript.exe Host Ip Js StartUp.exe PID 1716 wrote to memory of 880 1716 Host Ip Js StartUp.exe Notepad.exe PID 1716 wrote to memory of 880 1716 Host Ip Js StartUp.exe Notepad.exe PID 1716 wrote to memory of 880 1716 Host Ip Js StartUp.exe Notepad.exe PID 1716 wrote to memory of 880 1716 Host Ip Js StartUp.exe Notepad.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Request Quote_PDF.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\MWOUSBLQqc.js"2⤵
-
C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe"C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe"C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exeFilesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exeFilesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exeFilesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exeFilesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
C:\Users\Admin\AppData\Roaming\MWOUSBLQqc.jsFilesize
6KB
MD57dfdac8b085ea48e40e4cff53194c3a0
SHA1c7d8a0b17be3fab76a24380207caee98942776d8
SHA256640d57cc69797a8b54bf9aa305b1891e5bc927589c135f7033d5e72ca0c38a15
SHA51273c9429f30b7794933543faa7f18b0457e5a7f71864dbac94533eee4afdeac1f2c4d15a9b43c596a236655beabad3d03c91237482bb9d7afb178bfe40636f0af
-
\Users\Admin\AppData\Roaming\Googlee\Notepad.exeFilesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
\Users\Admin\AppData\Roaming\Googlee\Notepad.exeFilesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
\Users\Admin\AppData\Roaming\Googlee\Notepad.exeFilesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
memory/880-63-0x0000000000000000-mapping.dmp
-
memory/1360-55-0x0000000000000000-mapping.dmp
-
memory/1684-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmpFilesize
8KB
-
memory/1716-59-0x0000000074AB1000-0x0000000074AB3000-memory.dmpFilesize
8KB
-
memory/1716-57-0x0000000000000000-mapping.dmp