Analysis
- max time kernel
10s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
05/07/2021, 09:51
General
- Target Purchase LOI.jar
- Size 168KB
- Sample210705-5asdfgllaj
- SHA256 bf8ee3c8ac5e570987fb535ee8c47c19ccbf400193610fa34cb31ddd48a81cd0
Malware Config
Signatures
- Drops file in Program Files directory 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Purchase LOI.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wscript.exewscript C:\Users\Admin\nxaqdyrpok.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\dkqltfvn.txt"3⤵
- Drops file in Program Files directory
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2684-122-0x0000000001210000-0x0000000001211000-memory.dmp
memory/2684-121-0x0000000003220000-0x0000000003490000-memory.dmp
memory/2684-123-0x0000000001210000-0x0000000001211000-memory.dmp
memory/2684-125-0x00000000034A0000-0x00000000034B0000-memory.dmp
memory/2684-124-0x0000000003490000-0x00000000034A0000-memory.dmp
memory/2684-127-0x00000000034C0000-0x00000000034D0000-memory.dmp
memory/2684-126-0x00000000034B0000-0x00000000034C0000-memory.dmp
memory/2684-128-0x00000000034D0000-0x00000000034E0000-memory.dmp
memory/2684-129-0x00000000034E0000-0x00000000034F0000-memory.dmp
memory/3944-116-0x00000000007D0000-0x00000000007D1000-memory.dmp
memory/3944-114-0x0000000002670000-0x00000000028E0000-memory.dmp