06ac3f97223310f9f49612d413a2b568457faee0ecb06cb73e6dde2e0bf4eeb1

General

Target
SNK09876545678900.js
Size 1.9MB
Sample260830-mt6h2styay
SHA256 06ac3f97223310f9f49612d413a2b568457faee0ecb06cb73e6dde2e0bf4eeb1
MD5 4ba1e8fe61c8eb9831bfcd4fd0e456f5
SHA1 1d2dc624ed7e8b50d0f28949238f72e64cc670a0
SHA512 346e19ff2b3c0ef4d625144065907003414ab23aeb60405023650b913f58a1c39f8d0fd2bdda78be9f299aedbf36ed61829566c022f2a17257c7360d341e9254
SSDEEP 24576:OU+aoFuQYcZsnVFVsxUA83yONBKMD0n7zT37KjdI:2/AUuPy/5
TLSH
T10D957C0B0B3C237B9FA10362146DD50953F84AC5D877AF492A2ED4B46E74E1F26A85FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4924	cmd.exe
2600	cmd.exe
1940	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4440	schtasks.exe
4104	schtasks.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4924	3316	wscript.exe	89
PID 4924 wrote to memory of 4440	4924	cmd.exe	91
PID 3596 wrote to memory of 2600	3596	WScript.exe	94
PID 2600 wrote to memory of 4104	2600	cmd.exe	96
PID 3316 wrote to memory of 1940	3316	wscript.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\SNK09876545678900.js
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 15 /tn SNK09876545678900.js /tr C:\Users\Admin\Pictures\SNK09876545678900.js /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 15 /tn SNK09876545678900.js /tr C:\Users\Admin\Pictures\SNK09876545678900.js /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Roaming\support.exe" "C:\Users\Admin\AppData\Roaming\au.dat""
  2⤵
  - Executes a command shell one-liner
  PID:1940

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Pictures\SNK09876545678900.js"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 15 /tn SNK09876545678900.js /tr C:\Users\Admin\Pictures\SNK09876545678900.js /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 15 /tn SNK09876545678900.js /tr C:\Users\Admin\Pictures\SNK09876545678900.js /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

JavaScript

1

T1059.007

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.zip

Path C:\Users\Admin\AppData\Roaming\app.zip
Size 532KB
SHA256 13c9cdd4e8901593bd24850bda875ff8d7e7beeed97f0e2ff7df6bc701b8852a
MD5 2395782ecb642c10ceb9223a67dda8b3
SHA1 19ccec8eac263881022cfb2650c135d42cdfb952
SHA512 15efb0c2b961a96998f210dd3e67cf78b4bb3efaf8427d289d7e580e0434f80bfb4af0e6484bff621dc30caa91b490ac5b7e185e99e818bc4e47f612ed2357be
SSDEEP 12288:117jChsIcTbJZAvq8xEWCnmld08+2yFluGE8kqV:1dhbudxRemld08FEluGE18
TLSH
T191C4232315169E6B206C2E9B76729435ACB226589C7F445BD900F2473B4BA0B334FDBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

au.ini

Path C:\Users\Admin\AppData\Roaming\au.ini
Size 82KB
SHA256 a0409b392969ca38160056a95bc80e1a16224754d94791eb972e16a54e2f75f4
MD5 dbce19bf59d7a481c3f69694f5f9084e
SHA1 cec1352dfa16dcb098a4ad21b630fc8e9bc2f361
SHA512 ee88f5a7ab0158cf0c56d6b445531bf334f9316996eac06e5f6b130d864a4fdd4e70422413dd55ba0ff6ffa4090f257bb4f19f2ca2e48d6de52dcb5b29a89716
SSDEEP 1536:lxjMLGhM0UGOxTlO7vxgI3Dq6jFhfSGhYzwZMWin4lGjQAnN:lxjMLyMFnSxzqIqzhWin4lGjQkN
TLSH
T15C83025DA7CA13205617E756C8A44305DC4ADA3C197DE30F366BED1AE5043EA832CADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

support.exe

Path C:\Users\Admin\AppData\Roaming\support.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads