Analysis
- max time kernel
147s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system - submitted
11/10/2023, 08:23
Static task
static1
Behavioral task
behavioral1
Sample
7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js
Resource
win10v2004-20230915-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js
- Size 3.1MB
- Sample231011-kakfcsda82
- SHA256 7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46
- MD5 cd12101e3da7cfc1e15be51324d97f26
- SHA1 3ef05de60568b30104e18a72b783c8e21fb83c01
- SHA512 fb26613b48898ebaa72f6e2188b7bda90aedd7e1d6ee6190d7fb6c53cbfd504910160ee3b902bbb3c3cb470ef710409f4bb6d742e2085cc154788b535c6b1ae1
- SSDEEP 768:qQKDwkB5j+Dd3MLyi/vdvK8cuUzwJBO0enr8uYUlN8b6iLBJbr59RlwDh:x8wkDaDd3gyiVAz10+ouFkPr52d
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Blocklisted process makes network request 49 IoCs
flow pid Process 6 4908 wscript.exe 11 4432 wscript.exe 15 2164 wscript.exe 27 4908 wscript.exe 31 2164 wscript.exe 35 4432 wscript.exe 36 4908 wscript.exe 37 2164 wscript.exe 38 4432 wscript.exe 52 2164 wscript.exe 53 4908 wscript.exe 54 4432 wscript.exe 55 2164 wscript.exe 60 4908 wscript.exe 62 4432 wscript.exe 67 2164 wscript.exe 68 4908 wscript.exe 69 4432 wscript.exe 70 2164 wscript.exe 72 4908 wscript.exe 73 4432 wscript.exe 74 2164 wscript.exe 76 4908 wscript.exe 77 4432 wscript.exe 78 2164 wscript.exe 79 4908 wscript.exe 82 4432 wscript.exe 84 2164 wscript.exe 85 4908 wscript.exe 86 4432 wscript.exe 88 2164 wscript.exe 89 4908 wscript.exe 90 4432 wscript.exe 91 2164 wscript.exe 92 4908 wscript.exe 93 4432 wscript.exe 94 2164 wscript.exe 95 4908 wscript.exe 96 4432 wscript.exe 97 2164 wscript.exe 98 4908 wscript.exe 99 4432 wscript.exe 100 2164 wscript.exe 101 4908 wscript.exe 104 4432 wscript.exe 105 2164 wscript.exe 108 4908 wscript.exe 109 2164 wscript.exe 110 4432 wscript.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation wscript.exe - Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AkrDdIbORR.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AkrDdIbORR.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AkrDdIbORR.js wscript.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js\"" wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3700 wrote to memory of 4908 3700 wscript.exe 83 PID 3700 wrote to memory of 4908 3700 wscript.exe 83 PID 3700 wrote to memory of 2164 3700 wscript.exe 84 PID 3700 wrote to memory of 2164 3700 wscript.exe 84 PID 2164 wrote to memory of 4432 2164 wscript.exe 87 PID 2164 wrote to memory of 4432 2164 wscript.exe 87
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\AkrDdIbORR.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:4908
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\AkrDdIbORR.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:4432
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js
- Size 3.1MB
- SHA256 7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46
- MD5 cd12101e3da7cfc1e15be51324d97f26
- SHA1 3ef05de60568b30104e18a72b783c8e21fb83c01
- SHA512 fb26613b48898ebaa72f6e2188b7bda90aedd7e1d6ee6190d7fb6c53cbfd504910160ee3b902bbb3c3cb470ef710409f4bb6d742e2085cc154788b535c6b1ae1
- SSDEEP 768:qQKDwkB5j+Dd3MLyi/vdvK8cuUzwJBO0enr8uYUlN8b6iLBJbr59RlwDh:x8wkDaDd3gyiVAz10+ouFkPr52d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\AkrDdIbORR.js
- Size 1.1MB
- SHA256 51e48daa54231a3f5b056882c66fad891cb81d2603a0845e0b44668d4533a3c3
- MD5 397495356e508277e1aa6e2f24cf43b4
- SHA1 eac5ebb135efcf24988cfdf0c42e031630b701a4
- SHA512 953f63373cc8d0c7122def46fa9a97124123b6cac95bcfdf2d783b2be91139a43c51f1936d1197de26b461768bc94fa69911851ff012a8d0f7a5d637b6461fa4
- SSDEEP 96:w5A84xwtNCw864P9zYqEqnSN4pmEPOnCREdwWO87XKsEmE8Fv1E4F6y2cv09Rh:w5AmtM1641fS4WC8Il8Fv1E4F6yw9Rh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\AkrDdIbORR.js
- Size 1.1MB
- SHA256 51e48daa54231a3f5b056882c66fad891cb81d2603a0845e0b44668d4533a3c3
- MD5 397495356e508277e1aa6e2f24cf43b4
- SHA1 eac5ebb135efcf24988cfdf0c42e031630b701a4
- SHA512 953f63373cc8d0c7122def46fa9a97124123b6cac95bcfdf2d783b2be91139a43c51f1936d1197de26b461768bc94fa69911851ff012a8d0f7a5d637b6461fa4
- SSDEEP 96:w5A84xwtNCw864P9zYqEqnSN4pmEPOnCREdwWO87XKsEmE8Fv1E4F6y2cv09Rh:w5AmtM1641fS4WC8Il8Fv1E4F6yw9Rh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js
- Size 3.1MB
- SHA256 7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46
- MD5 cd12101e3da7cfc1e15be51324d97f26
- SHA1 3ef05de60568b30104e18a72b783c8e21fb83c01
- SHA512 fb26613b48898ebaa72f6e2188b7bda90aedd7e1d6ee6190d7fb6c53cbfd504910160ee3b902bbb3c3cb470ef710409f4bb6d742e2085cc154788b535c6b1ae1
- SSDEEP 768:qQKDwkB5j+Dd3MLyi/vdvK8cuUzwJBO0enr8uYUlN8b6iLBJbr59RlwDh:x8wkDaDd3gyiVAz10+ouFkPr52d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46_JC.js
- Size 3.1MB
- SHA256 7ef5dc83e3a2f53a078a034d6edb8b07684efe844af306b60e65509d61a01b46
- MD5 cd12101e3da7cfc1e15be51324d97f26
- SHA1 3ef05de60568b30104e18a72b783c8e21fb83c01
- SHA512 fb26613b48898ebaa72f6e2188b7bda90aedd7e1d6ee6190d7fb6c53cbfd504910160ee3b902bbb3c3cb470ef710409f4bb6d742e2085cc154788b535c6b1ae1
- SSDEEP 768:qQKDwkB5j+Dd3MLyi/vdvK8cuUzwJBO0enr8uYUlN8b6iLBJbr59RlwDh:x8wkDaDd3gyiVAz10+ouFkPr52d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AkrDdIbORR.js
- Size 1.1MB
- SHA256 51e48daa54231a3f5b056882c66fad891cb81d2603a0845e0b44668d4533a3c3
- MD5 397495356e508277e1aa6e2f24cf43b4
- SHA1 eac5ebb135efcf24988cfdf0c42e031630b701a4
- SHA512 953f63373cc8d0c7122def46fa9a97124123b6cac95bcfdf2d783b2be91139a43c51f1936d1197de26b461768bc94fa69911851ff012a8d0f7a5d637b6461fa4
- SSDEEP 96:w5A84xwtNCw864P9zYqEqnSN4pmEPOnCREdwWO87XKsEmE8Fv1E4F6y2cv09Rh:w5AmtM1641fS4WC8Il8Fv1E4F6yw9Rh
- MD5 SHA1 SHA512 SSDEEP