Analysis
-
max time kernel
40s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21/07/2023, 10:47
Static task
static1
Behavioral task
behavioral1
Sample
Specifikace objednvky.js
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Specifikace objednvky.js
Resource
win10v2004-20230703-en
General
-
Target
Specifikace objednvky.js
-
Size
24KB
-
MD5
4272d76e2efed7d323e14bccef987913
-
SHA1
a8cde379b41cfafb036896484844620a7fcc11c6
-
SHA256
39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55
-
SHA512
717ca100e5f2463b8aa675185e2dbd743a015fffe7654dab2b227691ed66e9443a3e387d31c3eeed63a22d1b3f77b213feec3c3fe6c1438ddf5313066f2583a9
-
SSDEEP
384:0B+UO8kwlbBtHS0ihYvG3bMZcCOQHp4aIX6xEzWZNxFlumanjjjIYNFLD5zvOJ:09ewl7tGr+Oy4aPOL13IoFLdzGJ
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 5 1384 wscript.exe 6 1384 wscript.exe 7 1384 wscript.exe 9 1384 wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Specifikace objednvky.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Windows\CurrentVersion\Run\1CYH0WDT4T = "\"C:\\Users\\Admin\\AppData\\Roaming\\Specifikace objedn?vky.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2728 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2904 taskmgr.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe -
Suspicious use of SendNotifyMessage 29 IoCs
pid Process 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe 2904 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1384 wrote to memory of 2728 1384 wscript.exe 32 PID 1384 wrote to memory of 2728 1384 wscript.exe 32 PID 1384 wrote to memory of 2728 1384 wscript.exe 32 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Specifikace objednvky.js"1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Specifikace objednvky.js2⤵
- Creates scheduled task(s)
PID:2728
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2904