Analysis
-
max time kernel
1195s -
max time network
1199s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
05/06/2023, 18:14
Static task
static1
Behavioral task
behavioral1
Sample
VQlpXNzQJz.js
Resource
win10-20230220-en
windows10-1703-x64
4 signatures
1200 seconds
Behavioral task
behavioral2
Sample
VQlpXNzQJz.js
Resource
win7-20230220-en
windows7-x64
4 signatures
1200 seconds
General
-
Target
VQlpXNzQJz.js
-
Size
346KB
-
MD5
3ed07b2cfc14457c448129ac338d1a9b
-
SHA1
e07cd37475c0a9e2c53d4f7df317c8b4be70855e
-
SHA256
ed505690251f92f79fb3341968a3283e69bcd4ffe08539593b1601fac515c36b
-
SHA512
db34f63ad7cd4580c200040f1ced68ef7477cf61e44304932a2989cda520a56e90bf51d27bcd8474f14600a92f25664befa9a64caf26c009d5ecb6a610b78fa5
-
SSDEEP
6144:eQfPBx5q0sQ1o7rsbHC01mDBpNW2mTMSbpuV8l/:eQ3B7qgpr
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 2 3240 wscript.exe 3 3240 wscript.exe 5 3240 wscript.exe 6 3240 wscript.exe 7 3240 wscript.exe 9 3240 wscript.exe 11 3240 wscript.exe 15 3240 wscript.exe 16 3240 wscript.exe 17 3240 wscript.exe 18 3240 wscript.exe 19 3240 wscript.exe 20 3240 wscript.exe 21 3240 wscript.exe 22 3240 wscript.exe 23 3240 wscript.exe 24 3240 wscript.exe 25 3240 wscript.exe 26 3240 wscript.exe 27 3240 wscript.exe 28 3240 wscript.exe 29 3240 wscript.exe 30 3240 wscript.exe 31 3240 wscript.exe 32 3240 wscript.exe 33 3240 wscript.exe 34 3240 wscript.exe 35 3240 wscript.exe 36 3240 wscript.exe 37 3240 wscript.exe 38 3240 wscript.exe 39 3240 wscript.exe 40 3240 wscript.exe 41 3240 wscript.exe 42 3240 wscript.exe 43 3240 wscript.exe 44 3240 wscript.exe 45 3240 wscript.exe 46 3240 wscript.exe 53 3240 wscript.exe 54 3240 wscript.exe 55 3240 wscript.exe 56 3240 wscript.exe 57 3240 wscript.exe 58 3240 wscript.exe 59 3240 wscript.exe 63 3240 wscript.exe 64 3240 wscript.exe 65 3240 wscript.exe 66 3240 wscript.exe 67 3240 wscript.exe 68 3240 wscript.exe 69 3240 wscript.exe 70 3240 wscript.exe 71 3240 wscript.exe 72 3240 wscript.exe 73 3240 wscript.exe 74 3240 wscript.exe 75 3240 wscript.exe 76 3240 wscript.exe 77 3240 wscript.exe 78 3240 wscript.exe 79 3240 wscript.exe 80 3240 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VQlpXNzQJz.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VQlpXNzQJz.js wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).