Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-03-2023 20:26
Static task
static1
Behavioral task
behavioral1
Sample
908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js
Resource
win10v2004-20230220-en
General
-
Target
908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js
-
Size
9.0MB
-
MD5
c80a36f6be68badf2169f87ef5284b46
-
SHA1
8eb62c3901b392b7c608c8849af3f49881eec24e
-
SHA256
908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8
-
SHA512
41cff549582af5b3c469655d0a738a88c7f55077d2e2fea20a1d0be92b848f008165d9886fe922e643c503cb3ac4a07f1800f68682ef4fa49aaa3612a7b622c7
-
SSDEEP
192:KZVh7E1mH9k2J2ZafWdfH1P2P1IFpLk8vII:MVm1mH9u1+qTtgI
Malware Config
Signatures
-
Blocklisted process makes network request 16 IoCs
Processes:
wscript.exeflow pid process 4 1724 wscript.exe 5 1724 wscript.exe 6 1724 wscript.exe 9 1724 wscript.exe 10 1724 wscript.exe 11 1724 wscript.exe 13 1724 wscript.exe 14 1724 wscript.exe 15 1724 wscript.exe 17 1724 wscript.exe 18 1724 wscript.exe 19 1724 wscript.exe 21 1724 wscript.exe 22 1724 wscript.exe 23 1724 wscript.exe 25 1724 wscript.exe -
Drops startup file 1 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\WQ38R62NDG = "\"C:\\Users\\Admin\\AppData\\Roaming\\908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.