ba68c2acc5b4ce72444fd74f4dab6661bad90e865b0992d5ff9bb4afe32f3557 | Triage

Analysis

max time kernel
5s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
13-01-2021 09:12

Sharing

Report Analysis Logs

General

Target

OCOLZ552720.js
Size

195KB
MD5

86f5e65bcc64e04ba7946d8071f213b1
SHA1

403129cb5514917a278e91e0643f852964912c03
SHA256

ba68c2acc5b4ce72444fd74f4dab6661bad90e865b0992d5ff9bb4afe32f3557
SHA512

8580b921516571a57edcf22de46be1b938167a19278fa1f2eb3de6994198a9d6e3d305f18dfe1ed8e293c2ab0ffb2464a5788756c3be3fd02cb352b5af3d691d

Score

5^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1308	1648	wscript.exe	26
PID 1648 wrote to memory of 1308	1648	wscript.exe	26
PID 1648 wrote to memory of 1308	1648	wscript.exe	26
PID 1308 wrote to memory of 1728	1308	javaw.exe	27
PID 1308 wrote to memory of 1728	1308	javaw.exe	27
PID 1308 wrote to memory of 1728	1308	javaw.exe	27

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\OCOLZ552720.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\dxwinnw.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\system32\wscript.exe
    wscript C:\Users\Admin\fquimaihdd.js
    3⤵
    PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-3-0x0000000002650000-0x0000000002654000-memory.dmp

Filesize
16KB

Download