Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
24/07/2023, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55.js
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55.js
Resource
win10v2004-20230703-en
General
-
Target
39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55.js
-
Size
24KB
-
MD5
4272d76e2efed7d323e14bccef987913
-
SHA1
a8cde379b41cfafb036896484844620a7fcc11c6
-
SHA256
39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55
-
SHA512
717ca100e5f2463b8aa675185e2dbd743a015fffe7654dab2b227691ed66e9443a3e387d31c3eeed63a22d1b3f77b213feec3c3fe6c1438ddf5313066f2583a9
-
SSDEEP
384:0B+UO8kwlbBtHS0ihYvG3bMZcCOQHp4aIX6xEzWZNxFlumanjjjIYNFLD5zvOJ:09ewl7tGr+Oy4aPOL13IoFLdzGJ
Malware Config
Extracted
vjw0rm
http://severdops.ddns.net:5050
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 4 1324 wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Windows\CurrentVersion\Run\1CYH0WDT4T = "\"C:\\Users\\Admin\\AppData\\Roaming\\39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2448 schtasks.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1324 wrote to memory of 2448 1324 wscript.exe 29 PID 1324 wrote to memory of 2448 1324 wscript.exe 29 PID 1324 wrote to memory of 2448 1324 wscript.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55.js2⤵
- Creates scheduled task(s)
PID:2448
-