Overview

overview

3

Static

static

URLScan

urlscan

1

https://js10.absolut...

windows7-x64

3

https://js10.absolut...

windows10-2004-x64

1

Analysis

  • max time kernel
    195s
  • max time network
    185s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/09/2022, 07:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://js10.absoluteroute.com/js/customs\eb34e53a0c.js?0.5279121954592323

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
    adwarespyware
  • Modifies registry class 51 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://js10.absoluteroute.com/js/customs\eb34e53a0c.js?0.5279121954592323
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:240
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:240 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1280
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\eb34e53a0c.js
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\eb34e53a0c.js"
      2⤵
        PID:1768
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\eb34e53a0c.js
      1⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:828
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\eb34e53a0c.js
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:320
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\eb34e53a0c.js
      1⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
        "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\eb34e53a0c.js"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:1968

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      60KB

      MD5

      d15aaa7c9be910a9898260767e2490e1

      SHA1

      2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

      SHA256

      f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

      SHA512

      7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      129d0ae861bcad6106874ee309387cb4

      SHA1

      22e309213724207a40ed74b9299026fc759ea0cf

      SHA256

      c0ad503015131f9c59ea0e4366b8aec14e72cd9b0db4cf4441d57b2a0b10dae3

      SHA512

      5fd248b038a236447e75ad74cb8a338d16d57a776d82c3f7b7fc87fd382f9ebf96210643f91e756a94731d96d9365cb4a72461b1181b19338e71b5554dc59186

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1YKD3CN4.txt
      Filesize

      603B

      MD5

      093a59facaaa0a06be1b6f5e797b37ae

      SHA1

      75e7fd41ea58e8b85fe781d3afb8e35916ff7546

      SHA256

      ba1146f9d060207abee87b98ae8d50ab05b881196053b5b6ee3535fcfc07eba7

      SHA512

      be2ac53de209afd6f5a401c8c585fc5665b12e54906e05837ba985a5e78d6208cb7b4976a3d884c693485a715cfb236bb83bf39b83918874928c39aaed2aa4db

      Download Submit

    • C:\Users\Admin\Desktop\eb34e53a0c.js.ow09zk4.partial
      Filesize

      89KB

      MD5

      010e4263d8157aa43f59a4c6addbea7a

      SHA1

      16710b274a57362ca13e3d5b9f64a69b3693e3a6

      SHA256

      dfd1e29db3e8ccdd7a8fb234bc7f406df8ad4d460d3c2d937e63ab70e123ad48

      SHA512

      fe815fa6d6b52824f8c8dba6fc6b51cfd29865d669d46f1b34cb1a325ad44509265e197c1d1ef5293e0d03e6057e268c16954148536c7519836346831ddc88a2

      Download Submit

    • memory/1072-55-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

      Filesize

      8KB

      Download