Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29-03-2023 07:48
Static task
static1
Behavioral task
behavioral1
Sample
HAWB#68564359.pdf.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
HAWB#68564359.pdf.js
Resource
win10v2004-20230220-en
General
-
Target
HAWB#68564359.pdf.js
-
Size
4.5MB
-
MD5
9cf2c793029ae8dd84a387ba66e8c432
-
SHA1
48f6d8e5c4f55434a3d1fdc1531bd37fb6248d10
-
SHA256
d76d9fa7fa75a31b2a62804c8925a1c352f407831865bebc005b7f01676b5ac9
-
SHA512
33dd2fbc290c8feb31570e200f469729d5385e3f214edb4299b47bd841a0cd24a9ea211808e6c58cef63a812b27558852dbed2daf0cfac8953b3d028fd019848
-
SSDEEP
24576:8NLb0+2xYFsLoDw9svltZ7r55HNYYkY4WOxbZQCgvRo5PD1rMLSeGU0pOlBY9Pcw:3ueQa
Malware Config
Signatures
-
Blocklisted process makes network request 37 IoCs
flow pid Process 6 1736 wscript.exe 10 268 wscript.exe 11 1628 wscript.exe 13 268 wscript.exe 14 1736 wscript.exe 15 1628 wscript.exe 18 1736 wscript.exe 19 1628 wscript.exe 24 1736 wscript.exe 25 1628 wscript.exe 27 268 wscript.exe 29 1736 wscript.exe 30 1628 wscript.exe 32 1736 wscript.exe 35 1628 wscript.exe 38 1736 wscript.exe 39 1628 wscript.exe 41 268 wscript.exe 43 1736 wscript.exe 45 1628 wscript.exe 46 1736 wscript.exe 48 1628 wscript.exe 53 1736 wscript.exe 54 1628 wscript.exe 56 268 wscript.exe 58 1736 wscript.exe 59 1628 wscript.exe 61 1736 wscript.exe 63 1628 wscript.exe 67 1736 wscript.exe 68 1628 wscript.exe 70 268 wscript.exe 72 1736 wscript.exe 74 1628 wscript.exe 75 1736 wscript.exe 78 1628 wscript.exe 81 1736 wscript.exe -
Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HAWB#68564359.pdf.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xQgwkAjhRq.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HAWB#68564359.pdf.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xQgwkAjhRq.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xQgwkAjhRq.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HAWB#68564359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\HAWB#68564359.pdf.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\HAWB#68564359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\HAWB#68564359.pdf.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HAWB#68564359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\HAWB#68564359.pdf.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\HAWB#68564359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\HAWB#68564359.pdf.js\"" wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1736 1740 wscript.exe 28 PID 1740 wrote to memory of 1736 1740 wscript.exe 28 PID 1740 wrote to memory of 1736 1740 wscript.exe 28 PID 1740 wrote to memory of 268 1740 wscript.exe 29 PID 1740 wrote to memory of 268 1740 wscript.exe 29 PID 1740 wrote to memory of 268 1740 wscript.exe 29 PID 268 wrote to memory of 1628 268 wscript.exe 31 PID 268 wrote to memory of 1628 268 wscript.exe 31 PID 268 wrote to memory of 1628 268 wscript.exe 31
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\HAWB#68564359.pdf.js1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xQgwkAjhRq.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:1736
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\HAWB#68564359.pdf.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xQgwkAjhRq.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:1628
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.5MB
MD59cf2c793029ae8dd84a387ba66e8c432
SHA148f6d8e5c4f55434a3d1fdc1531bd37fb6248d10
SHA256d76d9fa7fa75a31b2a62804c8925a1c352f407831865bebc005b7f01676b5ac9
SHA51233dd2fbc290c8feb31570e200f469729d5385e3f214edb4299b47bd841a0cd24a9ea211808e6c58cef63a812b27558852dbed2daf0cfac8953b3d028fd019848
-
Filesize
4.5MB
MD59cf2c793029ae8dd84a387ba66e8c432
SHA148f6d8e5c4f55434a3d1fdc1531bd37fb6248d10
SHA256d76d9fa7fa75a31b2a62804c8925a1c352f407831865bebc005b7f01676b5ac9
SHA51233dd2fbc290c8feb31570e200f469729d5385e3f214edb4299b47bd841a0cd24a9ea211808e6c58cef63a812b27558852dbed2daf0cfac8953b3d028fd019848
-
Filesize
4.5MB
MD59cf2c793029ae8dd84a387ba66e8c432
SHA148f6d8e5c4f55434a3d1fdc1531bd37fb6248d10
SHA256d76d9fa7fa75a31b2a62804c8925a1c352f407831865bebc005b7f01676b5ac9
SHA51233dd2fbc290c8feb31570e200f469729d5385e3f214edb4299b47bd841a0cd24a9ea211808e6c58cef63a812b27558852dbed2daf0cfac8953b3d028fd019848
-
Filesize
346KB
MD50fbcb6f83b0f64e57835d021bb6e917d
SHA10fa656e1cf06a0ea20e19a4ddd951f0d0d05dc38
SHA256c518c547d809de7ccae1259611bcb52d6fa435cff67c910d25c5b961ddc45466
SHA51270f322596a2ba8e079d39d35a10e771f8269dc08e03713736ba070f6cf34cf9bbcb9ac1065a66ad0a0afb66ad68e000953e593164d8858224ce1aeb4cde5120f
-
Filesize
346KB
MD50fbcb6f83b0f64e57835d021bb6e917d
SHA10fa656e1cf06a0ea20e19a4ddd951f0d0d05dc38
SHA256c518c547d809de7ccae1259611bcb52d6fa435cff67c910d25c5b961ddc45466
SHA51270f322596a2ba8e079d39d35a10e771f8269dc08e03713736ba070f6cf34cf9bbcb9ac1065a66ad0a0afb66ad68e000953e593164d8858224ce1aeb4cde5120f
-
Filesize
346KB
MD50fbcb6f83b0f64e57835d021bb6e917d
SHA10fa656e1cf06a0ea20e19a4ddd951f0d0d05dc38
SHA256c518c547d809de7ccae1259611bcb52d6fa435cff67c910d25c5b961ddc45466
SHA51270f322596a2ba8e079d39d35a10e771f8269dc08e03713736ba070f6cf34cf9bbcb9ac1065a66ad0a0afb66ad68e000953e593164d8858224ce1aeb4cde5120f