Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2023, 15:43
Static task
static1
Behavioral task
behavioral1
Sample
e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae_JC.js
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae_JC.js
Resource
win10v2004-20230703-en
General
-
Target
e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae_JC.js
-
Size
3KB
-
MD5
d65a553af676282e15cb3ab7cf998998
-
SHA1
dd76b76df265973b7aea2f3ffaba45123024f05c
-
SHA256
e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae
-
SHA512
d7ca6988dfda70a9e390ebe2a65c2a01bd0fe2407df8be83276a1f31781b1bc143daad40ff90310d0fe78c3beffc3b817b8c32637de732c049689d12b62ab4a7
Malware Config
Signatures
-
Blocklisted process makes network request 16 IoCs
flow pid Process 6 768 wscript.exe 14 768 wscript.exe 21 768 wscript.exe 22 768 wscript.exe 35 768 wscript.exe 36 768 wscript.exe 37 768 wscript.exe 40 768 wscript.exe 41 768 wscript.exe 42 768 wscript.exe 47 768 wscript.exe 48 768 wscript.exe 49 768 wscript.exe 50 768 wscript.exe 51 768 wscript.exe 54 768 wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae_JC.js wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5RQEBVICNC = "\"C:\\Users\\Admin\\AppData\\Roaming\\e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae_JC.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5068 schtasks.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 768 wrote to memory of 5068 768 wscript.exe 82 PID 768 wrote to memory of 5068 768 wscript.exe 82
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae_JC.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae_JC.js2⤵
- Creates scheduled task(s)
PID:5068
-