ba68c2acc5b4ce72444fd74f4dab6661bad90e865b0992d5ff9bb4afe32f3557

Analysis

max time kernel
5s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
13-01-2021 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OCOLZ552720.js
Size

195KB
MD5

86f5e65bcc64e04ba7946d8071f213b1
SHA1

403129cb5514917a278e91e0643f852964912c03
SHA256

ba68c2acc5b4ce72444fd74f4dab6661bad90e865b0992d5ff9bb4afe32f3557
SHA512

8580b921516571a57edcf22de46be1b938167a19278fa1f2eb3de6994198a9d6e3d305f18dfe1ed8e293c2ab0ffb2464a5788756c3be3fd02cb352b5af3d691d

Score

5^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exejavaw.exe

description	pid	process	target process
PID 1648 wrote to memory of 1308	1648	wscript.exe	javaw.exe
PID 1648 wrote to memory of 1308	1648	wscript.exe	javaw.exe
PID 1648 wrote to memory of 1308	1648	wscript.exe	javaw.exe
PID 1308 wrote to memory of 1728	1308	javaw.exe	wscript.exe
PID 1308 wrote to memory of 1728	1308	javaw.exe	wscript.exe
PID 1308 wrote to memory of 1728	1308	javaw.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\OCOLZ552720.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\dxwinnw.txt"
2⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\system32\wscript.exe
wscript C:\Users\Admin\fquimaihdd.js
3⤵
PID:1728

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\dxwinnw.txt
MD5
8c8bd4c98378cbfd170cef3fea63ad10

SHA1
289800651479f0f5180c2bd85330933cd84d9f55

SHA256
e0384f56f6db64896fbc40b41f82e2559abf10880fd618677867c23d45ab003c

SHA512
95cb754afd2e61f8849b640c14ee1940667d29f6cf215664c17e3206ad58e236ccea2cc0070f9d2246b92257db5361804053f30f2a9dd25ad39cbc0f0f9bd163

Download Submit
memory/1308-2-0x0000000000000000-mapping.dmp

Download
memory/1648-3-0x0000000002650000-0x0000000002654000-memory.dmp

Filesize
16KB

Download
memory/1728-6-0x0000000000000000-mapping.dmp

Download