Analysis
- max time kernel
102s - max time network
110s - platform
windows10_x64 - resource
win10v20210410 - submitted
03/05/2021, 02:36
General
- Target Annexure A-61322.jar
- Size 126KB
- Sample210503-2yglcev2p2
- SHA256 ca0c5787943929cb6e8efb4403d58a9524b3afcb1bc0da075f8da333beab58bc
Malware Config
Signatures
- Drops file in Program Files directory 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Annexure A-61322.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wscript.exewscript C:\Users\Admin\kspzxqsvwb.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\dshvviviub.txt"3⤵
- Drops file in Program Files directory
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2444-122-0x0000000000D60000-0x0000000000D61000-memory.dmp
memory/2444-121-0x00000000029D0000-0x0000000002C40000-memory.dmp
memory/2444-124-0x0000000002C50000-0x0000000002C60000-memory.dmp
memory/2444-125-0x0000000002C60000-0x0000000002C70000-memory.dmp
memory/2444-126-0x0000000002C70000-0x0000000002C80000-memory.dmp
memory/2444-123-0x0000000002C40000-0x0000000002C50000-memory.dmp
memory/2444-127-0x0000000000D60000-0x0000000000D61000-memory.dmp
memory/2444-129-0x0000000002C90000-0x0000000002CA0000-memory.dmp
memory/2444-130-0x0000000002CA0000-0x0000000002CB0000-memory.dmp
memory/2444-128-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/3944-116-0x0000000001460000-0x0000000001461000-memory.dmp
memory/3944-114-0x0000000003300000-0x0000000003570000-memory.dmp