Analysis
-
max time kernel
1766s -
max time network
1768s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
16-03-2023 18:01
Static task
static1
Behavioral task
behavioral1
Sample
908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js
-
Size
9.0MB
-
MD5
c80a36f6be68badf2169f87ef5284b46
-
SHA1
8eb62c3901b392b7c608c8849af3f49881eec24e
-
SHA256
908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8
-
SHA512
41cff549582af5b3c469655d0a738a88c7f55077d2e2fea20a1d0be92b848f008165d9886fe922e643c503cb3ac4a07f1800f68682ef4fa49aaa3612a7b622c7
-
SSDEEP
192:KZVh7E1mH9k2J2ZafWdfH1P2P1IFpLk8vII:MVm1mH9u1+qTtgI
Malware Config
Extracted
vjw0rm
http://demon666.duckdns.org:9011
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 4 1052 wscript.exe 6 1052 wscript.exe 7 1052 wscript.exe 8 1052 wscript.exe 10 1052 wscript.exe 11 1052 wscript.exe 12 1052 wscript.exe 14 1052 wscript.exe 15 1052 wscript.exe 16 1052 wscript.exe 18 1052 wscript.exe 19 1052 wscript.exe 20 1052 wscript.exe 22 1052 wscript.exe 23 1052 wscript.exe 24 1052 wscript.exe 26 1052 wscript.exe 27 1052 wscript.exe 28 1052 wscript.exe 30 1052 wscript.exe 31 1052 wscript.exe 32 1052 wscript.exe 34 1052 wscript.exe 35 1052 wscript.exe 36 1052 wscript.exe 38 1052 wscript.exe 39 1052 wscript.exe 40 1052 wscript.exe 42 1052 wscript.exe 43 1052 wscript.exe 44 1052 wscript.exe 46 1052 wscript.exe 47 1052 wscript.exe 48 1052 wscript.exe 50 1052 wscript.exe 51 1052 wscript.exe 52 1052 wscript.exe 54 1052 wscript.exe 55 1052 wscript.exe 56 1052 wscript.exe 58 1052 wscript.exe 59 1052 wscript.exe 60 1052 wscript.exe 62 1052 wscript.exe 63 1052 wscript.exe 64 1052 wscript.exe 66 1052 wscript.exe 67 1052 wscript.exe 68 1052 wscript.exe 70 1052 wscript.exe 71 1052 wscript.exe 72 1052 wscript.exe 74 1052 wscript.exe 75 1052 wscript.exe 76 1052 wscript.exe 78 1052 wscript.exe 79 1052 wscript.exe 80 1052 wscript.exe 82 1052 wscript.exe 83 1052 wscript.exe 84 1052 wscript.exe 86 1052 wscript.exe 87 1052 wscript.exe 88 1052 wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\WQ38R62NDG = "\"C:\\Users\\Admin\\AppData\\Roaming\\908734b8110bcf4d13e860d05aa0c374f056c027e6a7c594ecff219679f58de8.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.