Analysis
- max time kernel
138s - max time network
138s - platform
windows10_x64 - resource
win10v20201028 - submitted
07/04/2021, 19:00
General
- Target DHL Paket.jar
- Size 187KB
- Sample210407-fdwfcvfq1x
- SHA256 abda456f2f4994e4e619ecfe2ef5dd2e1a4fd6d4e3be8d27074052703362eb15
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\DHL Paket.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wscript.exewscript C:\Users\Admin\vcvqiyhoim.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ltprefpkzt.txt"3⤵
- Drops file in Program Files directory
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3884-2-0x0000000002E40000-0x00000000030B0000-memory.dmp
memory/3952-8-0x00000000033B0000-0x0000000003620000-memory.dmp
memory/3952-10-0x0000000003630000-0x0000000003640000-memory.dmp
memory/3952-9-0x0000000003620000-0x0000000003630000-memory.dmp
memory/3952-11-0x0000000003640000-0x0000000003650000-memory.dmp