Overview

overview

10

Static

static

10

630a2dec95...ebc.js

windows10-1703-x64

5

Resubmissions

10-05-2024 15:02

240510-sern8sbg4x 10

30-04-2024 20:30

240430-y99q7aha99 10

30-04-2024 20:29

240430-y9v8ssha94 10

24-03-2024 03:37

240324-d6v4eahc35 10

24-03-2024 03:36

240324-d6c8labh2t 10

23-03-2024 01:22

240323-brmglsbe62 10

23-03-2024 01:19

240323-bpxjsseb5v 10

23-03-2024 01:18

240323-bnxheaeb4s 10

23-03-2024 01:17

240323-bnjxbabe28 10

Analysis

  • max time kernel
    1855s
  • max time network
    1824s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26-02-2024 07:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    630a2dec95e68275d9ffa75a87d4809a9da69434c30cd95099fa401c9e4c9ebc.js

  • Size

    475KB

  • MD5

    b3466ea07dc83fcce7eeba0dbc1c8aa6

  • SHA1

    1aeee7429327e3241fccddd4b2f06b8e6fb67ab8

  • SHA256

    630a2dec95e68275d9ffa75a87d4809a9da69434c30cd95099fa401c9e4c9ebc

  • SHA512

    f8b4f246112071a91c125ce6384a0b86d6be1b9631801e53e9e4f2b8027b4b5acd9aedf8b4fab7c7dd69e1729f1ef27b2aeea1f940ffceaf8f2abd320fbb57e2

  • SSDEEP

    3072:VVnNs48OW0kT97kFUxj3mKMABR3R7DyWvEXNemiS0KPMID5whT0bMNj69wrVRs3f:nbkw83zLJtMtwmIj6ERCcXhe

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\630a2dec95e68275d9ffa75a87d4809a9da69434c30cd95099fa401c9e4c9ebc.js
    1⤵
      PID:4228
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2764
      • C:\Windows\system32\mspaint.exe
        "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Roaming\BlockSplit.dib"
        1⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4340
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
        1⤵
          PID:1140
        • C:\Windows\System32\Notepad.exe
          "C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Local\Temp\630a2dec95e68275d9ffa75a87d4809a9da69434c30cd95099fa401c9e4c9ebc.js
          1⤵
          • Opens file in notepad (likely ransom note)
          • Suspicious use of FindShellTrayWindow
          PID:1308
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
          1⤵
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1524
        • C:\Windows\system32\browser_broker.exe
          C:\Windows\system32\browser_broker.exe -Embedding
          1⤵
          • Modifies Internet Explorer settings
          PID:4948
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies registry class
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4928
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3504
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4500
        • C:\Windows\write.exe
          "C:\Windows\write.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:3484
          • C:\Program Files\Windows NT\Accessories\wordpad.exe
            "C:\Program Files\Windows NT\Accessories\wordpad.exe"
            2⤵
            • Suspicious use of SetWindowsHookEx
            PID:4312
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /0
          1⤵
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1080
          • C:\Windows\system32\mmc.exe
            "C:\Windows\system32\mmc.exe" "C:\Windows\System32\services.msc"
            2⤵
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4308

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Query Registry

        2
        T1012

        Peripheral Device Discovery

        1
        T1120

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFFDFB120BF3836D0D.TMP
          Filesize

          16KB

          MD5

          79cc55a0a0e0fd22f8ec0c088b781b3d

          SHA1

          57844bbf016c42efa4e141fb58d23e4bbab7fcbf

          SHA256

          3a27ea5f4b96f22bc37dce48b11fc4b4e170a056b456ab582db6a84a55cb7b5a

          SHA512

          40531bbd920323b4f4f51fee32ca99f4ddea700f57ff2e815452645d31e75348a74d8b8241aaa42e7e9fb531b362eea96cd64ca1336252b968a8adfe6662b34b

          Download Submit
        • memory/1524-85-0x000001AE04690000-0x000001AE04692000-memory.dmp
          Filesize

          8KB

          Download
        • memory/1524-17-0x000001AE7E400000-0x000001AE7E410000-memory.dmp
          Filesize

          64KB

          Download
        • memory/1524-36-0x000001AE043F0000-0x000001AE043F2000-memory.dmp
          Filesize

          8KB

          Download
        • memory/1524-1-0x000001AE7DB20000-0x000001AE7DB30000-memory.dmp
          Filesize

          64KB

          Download
        • memory/1524-92-0x000001AE043E0000-0x000001AE043E1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1524-88-0x000001AE044B0000-0x000001AE044B1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/4500-55-0x0000013FD3850000-0x0000013FD3852000-memory.dmp
          Filesize

          8KB

          Download
        • memory/4500-62-0x0000013FE45A0000-0x0000013FE45A2000-memory.dmp
          Filesize

          8KB

          Download
        • memory/4500-64-0x0000013FE45C0000-0x0000013FE45C2000-memory.dmp
          Filesize

          8KB

          Download
        • memory/4500-66-0x0000013FE45E0000-0x0000013FE45E2000-memory.dmp
          Filesize

          8KB

          Download
        • memory/4500-60-0x0000013FD3890000-0x0000013FD3892000-memory.dmp
          Filesize

          8KB

          Download
        • memory/4500-58-0x0000013FD3870000-0x0000013FD3872000-memory.dmp
          Filesize

          8KB

          Download