a1660698b8655cb721f71693178d2804caba8aa12c3a25446c6f7c665a30f2ff

General

Target

AGB EmektarMakina Ticaret.js
Size

135KB
MD5

5e1cbb6566f677da1d920c9d22f59bd7
SHA1

32e31e15fe42e4cb9e2a03698a5c7bc386311eb6
SHA256

a1660698b8655cb721f71693178d2804caba8aa12c3a25446c6f7c665a30f2ff
SHA512

6ffa6cb201b2c20403214072b41cafc0e3c3fefe642d475679f63b60b8cd607e090586ece4e86958337638fd87004df20e4f9946ac00fd29482aa0a951dedd66

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description pid process target process

PID 808 wrote to memory of 3796 808 wscript.exe java.exe
PID 808 wrote to memory of 3796 808 wscript.exe java.exe

description	pid	process	target process
PID 808 wrote to memory of 3796	808	wscript.exe	java.exe
PID 808 wrote to memory of 3796	808	wscript.exe	java.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\AGB EmektarMakina Ticaret.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:808

C:\Program Files\Java\jre1.8.0_66\bin\java.exe
"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Chriso09 Stub.jar"
2⤵
PID:3796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Chriso09 Stub.jar
MD5
577842a3d036c81926204ccbf5333da1

SHA1
674933be0aad1d7c514adab4f954f7dfd5432e58

SHA256
5d5ed41f5159cf4d0d15b235e0b2f510a967022e8537f872a1dee627485cdd77

SHA512
71aa1747e1c93c9f4cb66719339e454291074020fec6014899629f84ce4872a0d006f359a40d4bee1891279aeac91a76c6df2669a2696110dc1f1fbe9f1557ae

Download Submit
memory/3796-126-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/3796-117-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/3796-128-0x0000000002F80000-0x0000000002F90000-memory.dmp

Filesize
64KB

Download
memory/3796-129-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/3796-119-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/3796-121-0x0000000002F10000-0x0000000002F20000-memory.dmp

Filesize
64KB

Download
memory/3796-122-0x0000000002F20000-0x0000000002F30000-memory.dmp

Filesize
64KB

Download
memory/3796-123-0x0000000002F30000-0x0000000002F40000-memory.dmp

Filesize
64KB

Download
memory/3796-124-0x0000000002F40000-0x0000000002F50000-memory.dmp

Filesize
64KB

Download
memory/3796-125-0x0000000002F50000-0x0000000002F60000-memory.dmp

Filesize
64KB

Download
memory/3796-120-0x0000000002F90000-0x0000000002FA0000-memory.dmp

Filesize
64KB

Download
memory/3796-114-0x0000000000000000-mapping.dmp

Download
memory/3796-147-0x0000000003030000-0x0000000003040000-memory.dmp

Filesize
64KB

Download
memory/3796-116-0x0000000002C90000-0x0000000002F00000-memory.dmp

Filesize
2.4MB

Download
memory/3796-118-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/3796-130-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

Filesize
64KB

Download
memory/3796-131-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

Filesize
64KB

Download
memory/3796-132-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3796-133-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/3796-136-0x0000000002FE0000-0x0000000002FF0000-memory.dmp

Filesize
64KB

Download
memory/3796-135-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/3796-138-0x0000000002FF0000-0x0000000003000000-memory.dmp

Filesize
64KB

Download
memory/3796-141-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3796-143-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3796-145-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download
memory/3796-127-0x0000000002F70000-0x0000000002F80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing