9d9bbc055991e0bbbac7c53406375cac00c60b995b71402e73244f5df75ab159

Resubmissions

29/03/2023, 09:09

27/03/2023, 14:04

max time kernel
58s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2023, 14:04

Target
ss.js
Size 5KB
Sample230327-rdccgsfh2y
SHA256 9d9bbc055991e0bbbac7c53406375cac00c60b995b71402e73244f5df75ab159
MD5 2d2a1f6a169783349bb9f39be00153f0
SHA1 e7ea0e9a103f84d9dfc889e347c56a15d54029d3
SHA512 0fc09285e89bcef1a79c412752bbd35758c313515c3646c6fcd094ab52700cdbb08318bf82b75a4acab3fe5e9892935202329b257cc3e3ea2dcf0ea351348493
SSDEEP 96:mZzemAYeoUe2SjMTM3bMMTMEq196cw7CE/VKacgWAETUiWWmIWta1FijiJ:agYBUe1jqRq7qcvmE/ADgXEuWmIWA1t
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4480	5080	WerFault.exe	82

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1596	NOTEPAD.EXE

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ss.js
1⤵
PID:4660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:952

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 124 -p 5080 -ip 5080
1⤵
PID:4476

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5080 -s 1748
1⤵
- Program crash
PID:4480

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log
1⤵
- Opens file in notepad (likely ransom note)
PID:1596