Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
18-11-2022 04:03
Static task
static1
Behavioral task
behavioral1
Sample
AB63.iso
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
AB63.iso
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
WW.js
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
WW.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
animators/extrapolates.dll
Resource
win7-20221111-en
General
-
Target
WW.js
-
Size
9KB
-
MD5
6522ad4f1e1620d242c5a76a3abd26ef
-
SHA1
b39d6a4b0989717ec089ea2e07e69662e7a1c5d9
-
SHA256
489be1bddb7b9af349836dfd5fc52cc35a7c620f7fbb3c6130be5f65c220e111
-
SHA512
385b5a8b1b62cfe3a142ec1a7672c46e4c21427a1d8a4aaaf20c6397adf3f621ddd1be40177520a6eefa92d5ac25ef919f588a09ee558cad4c3c8b697cd85d76
-
SSDEEP
192:0SLjDJq0Tavgx685UIroAKbP2KTMhS0OGYm5llWVjAvNzAWMuEvk7MgG+r5A6:jVq2k785UIro8KTMhSeYm5P2jiuuEjP4
Malware Config
Extracted
qakbot
404.30
BB06
1668670510
86.225.214.138:2222
71.183.236.133:443
182.66.197.35:443
70.66.199.12:443
76.80.180.154:995
180.151.104.143:443
92.149.205.238:2222
83.110.223.247:443
183.87.31.34:443
105.103.50.1:990
103.141.50.117:995
105.103.50.1:465
105.103.50.1:22
86.130.9.167:2222
86.99.15.243:2222
90.104.22.28:2222
172.117.139.142:995
176.142.207.63:443
142.161.27.232:2222
71.247.10.63:50003
108.6.249.139:443
184.176.154.83:995
47.34.30.133:443
71.247.10.63:995
92.207.132.174:2222
89.129.109.27:2222
197.148.17.17:2078
105.111.45.51:995
12.172.173.82:21
87.202.101.164:50000
184.153.132.82:443
74.66.134.24:443
24.64.114.59:3389
73.155.10.79:443
136.232.184.134:995
105.184.161.242:443
2.14.241.33:2222
72.82.136.90:443
73.36.196.11:443
82.31.37.241:443
24.116.45.121:443
213.67.255.57:2222
90.221.5.105:443
66.191.69.18:995
175.205.2.54:443
64.121.161.102:443
41.35.196.18:995
73.230.28.7:443
176.151.15.101:443
24.64.114.59:2222
85.59.61.52:2222
157.231.42.190:443
27.110.134.202:995
49.175.72.56:443
12.172.173.82:2087
12.172.173.82:22
50.68.204.71:995
213.91.235.146:443
174.77.209.5:443
117.186.222.30:993
76.127.192.23:443
50.68.204.71:443
109.11.175.42:2222
199.83.165.233:443
45.248.169.101:443
174.0.224.214:443
151.30.53.233:443
12.172.173.82:443
181.118.183.116:443
174.45.15.123:443
77.126.81.208:443
92.106.70.62:2222
82.121.73.56:2222
173.239.94.212:443
187.199.224.16:32103
183.82.100.110:2222
190.100.149.122:995
41.62.227.225:443
75.99.125.238:2222
2.84.98.228:2222
188.24.223.55:443
79.37.204.67:443
24.228.132.224:2222
69.119.123.159:2222
47.176.30.75:443
174.104.184.149:443
58.247.115.126:995
12.172.173.82:993
102.157.69.217:995
186.52.227.51:995
98.147.155.235:443
173.32.181.236:443
172.90.139.138:2222
75.143.236.149:443
75.98.154.19:443
74.92.243.113:50000
12.172.173.82:995
58.186.75.42:443
105.103.50.1:32103
121.122.99.151:995
12.172.173.82:50001
24.49.232.96:443
85.74.158.150:2222
75.156.125.215:995
68.47.128.161:443
71.31.101.183:443
75.191.246.70:443
80.0.74.165:443
87.65.160.87:995
70.64.77.115:443
81.229.117.95:2222
47.41.154.250:443
174.60.47.98:443
186.88.53.160:2222
84.143.91.238:443
47.185.141.97:443
69.133.162.35:443
84.35.26.14:995
74.33.84.227:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exewermgr.exepid process 1884 regsvr32.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe 1080 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 1884 regsvr32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
wscript.exeregsvr32.exeregsvr32.exedescription pid process target process PID 2024 wrote to memory of 584 2024 wscript.exe regsvr32.exe PID 2024 wrote to memory of 584 2024 wscript.exe regsvr32.exe PID 2024 wrote to memory of 584 2024 wscript.exe regsvr32.exe PID 2024 wrote to memory of 584 2024 wscript.exe regsvr32.exe PID 2024 wrote to memory of 584 2024 wscript.exe regsvr32.exe PID 584 wrote to memory of 1884 584 regsvr32.exe regsvr32.exe PID 584 wrote to memory of 1884 584 regsvr32.exe regsvr32.exe PID 584 wrote to memory of 1884 584 regsvr32.exe regsvr32.exe PID 584 wrote to memory of 1884 584 regsvr32.exe regsvr32.exe PID 584 wrote to memory of 1884 584 regsvr32.exe regsvr32.exe PID 584 wrote to memory of 1884 584 regsvr32.exe regsvr32.exe PID 584 wrote to memory of 1884 584 regsvr32.exe regsvr32.exe PID 1884 wrote to memory of 1080 1884 regsvr32.exe wermgr.exe PID 1884 wrote to memory of 1080 1884 regsvr32.exe wermgr.exe PID 1884 wrote to memory of 1080 1884 regsvr32.exe wermgr.exe PID 1884 wrote to memory of 1080 1884 regsvr32.exe wermgr.exe PID 1884 wrote to memory of 1080 1884 regsvr32.exe wermgr.exe PID 1884 wrote to memory of 1080 1884 regsvr32.exe wermgr.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\WW.js1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" animators\extrapolates.tmp2⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\regsvr32.exeanimators\extrapolates.tmp3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1080
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/584-55-0x0000000000000000-mapping.dmp
-
memory/1080-63-0x0000000000000000-mapping.dmp
-
memory/1080-66-0x0000000000100000-0x000000000012A000-memory.dmpFilesize
168KB
-
memory/1080-67-0x0000000000100000-0x000000000012A000-memory.dmpFilesize
168KB
-
memory/1884-57-0x0000000000000000-mapping.dmp
-
memory/1884-58-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1884-59-0x0000000000240000-0x000000000026A000-memory.dmpFilesize
168KB
-
memory/1884-60-0x0000000000240000-0x000000000026A000-memory.dmpFilesize
168KB
-
memory/1884-61-0x00000000001B0000-0x00000000001DE000-memory.dmpFilesize
184KB
-
memory/1884-62-0x0000000000240000-0x000000000026A000-memory.dmpFilesize
168KB
-
memory/1884-65-0x0000000000240000-0x000000000026A000-memory.dmpFilesize
168KB
-
memory/2024-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmpFilesize
8KB