ba68c2acc5b4ce72444fd74f4dab6661bad90e865b0992d5ff9bb4afe32f3557

Analysis

Target

OCOLZ552720.js
Size

195KB
MD5

86f5e65bcc64e04ba7946d8071f213b1
SHA1

403129cb5514917a278e91e0643f852964912c03
SHA256

ba68c2acc5b4ce72444fd74f4dab6661bad90e865b0992d5ff9bb4afe32f3557
SHA512

8580b921516571a57edcf22de46be1b938167a19278fa1f2eb3de6994198a9d6e3d305f18dfe1ed8e293c2ab0ffb2464a5788756c3be3fd02cb352b5af3d691d

Score

5^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exejavaw.exe

description	pid	process	target process
PID 1648 wrote to memory of 1308	1648	wscript.exe	javaw.exe
PID 1648 wrote to memory of 1308	1648	wscript.exe	javaw.exe
PID 1648 wrote to memory of 1308	1648	wscript.exe	javaw.exe
PID 1308 wrote to memory of 1728	1308	javaw.exe	wscript.exe
PID 1308 wrote to memory of 1728	1308	javaw.exe	wscript.exe
PID 1308 wrote to memory of 1728	1308	javaw.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\OCOLZ552720.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\dxwinnw.txt"
2⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\system32\wscript.exe
wscript C:\Users\Admin\fquimaihdd.js
3⤵
PID:1728

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\dxwinnw.txt

MD5
8c8bd4c98378cbfd170cef3fea63ad10

SHA1
289800651479f0f5180c2bd85330933cd84d9f55

SHA256
e0384f56f6db64896fbc40b41f82e2559abf10880fd618677867c23d45ab003c

SHA512
95cb754afd2e61f8849b640c14ee1940667d29f6cf215664c17e3206ad58e236ccea2cc0070f9d2246b92257db5361804053f30f2a9dd25ad39cbc0f0f9bd163

Download Submit
memory/1308-2-0x0000000000000000-mapping.dmp

Download
memory/1648-3-0x0000000002650000-0x0000000002654000-memory.dmp

Filesize
16KB

Download
memory/1728-6-0x0000000000000000-mapping.dmp

Download