Analysis
-
max time kernel
152s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-08-2021 18:58
Static task
static1
Behavioral task
behavioral1
Sample
cotización______________________fdp.js
Resource
win7v20210410
Behavioral task
behavioral2
Sample
cotización______________________fdp.js
Resource
win10v20210408
General
-
Target
cotización______________________fdp.js
-
Size
200KB
-
MD5
0982fc211767a61d7a3ef26ad2405be6
-
SHA1
e00d78a7ac396441217c133ba728af2a7aa67c9d
-
SHA256
c0d0da52fab57a9a3ac346e9aa1427c6f08198c2ef8f1f4ed9f556abc736cc52
-
SHA512
a3b15291adb751a83386b1ba0cf1fd89843237a7f4ce6402a11a5099a8f18f8caa652842532310c768734ff670f46df28da8893c869a8e564a17268c13897d57
Malware Config
Signatures
-
Blocklisted process makes network request 18 IoCs
Processes:
WScript.exeflow pid process 6 1996 WScript.exe 7 1996 WScript.exe 8 1996 WScript.exe 10 1996 WScript.exe 11 1996 WScript.exe 12 1996 WScript.exe 14 1996 WScript.exe 15 1996 WScript.exe 16 1996 WScript.exe 18 1996 WScript.exe 19 1996 WScript.exe 20 1996 WScript.exe 22 1996 WScript.exe 23 1996 WScript.exe 24 1996 WScript.exe 26 1996 WScript.exe 27 1996 WScript.exe 28 1996 WScript.exe -
Drops startup file 2 IoCs
Processes:
WScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iZuOkORefJ.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iZuOkORefJ.js WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\iZuOkORefJ.js\"" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1796 1392 WerFault.exe javaw.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 1796 WerFault.exe 1796 WerFault.exe 1796 WerFault.exe 1796 WerFault.exe 1796 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1796 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1796 WerFault.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
wscript.exejavaw.exedescription pid process target process PID 1084 wrote to memory of 1996 1084 wscript.exe WScript.exe PID 1084 wrote to memory of 1996 1084 wscript.exe WScript.exe PID 1084 wrote to memory of 1996 1084 wscript.exe WScript.exe PID 1084 wrote to memory of 1392 1084 wscript.exe javaw.exe PID 1084 wrote to memory of 1392 1084 wscript.exe javaw.exe PID 1084 wrote to memory of 1392 1084 wscript.exe javaw.exe PID 1392 wrote to memory of 1796 1392 javaw.exe WerFault.exe PID 1392 wrote to memory of 1796 1392 javaw.exe WerFault.exe PID 1392 wrote to memory of 1796 1392 javaw.exe WerFault.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\cotización______________________fdp.js1⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\iZuOkORefJ.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1996 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\xofegmuvwc.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1392 -s 1403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1796
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\iZuOkORefJ.jsMD5
ba88b3aeea9cd6596528119b0a81e127
SHA1af06129ded6c4e82b5c16607c3cbae77691d8407
SHA2567417fe426dc695b070d697d4cd2add731e80cab5bd1f15ae01c26d3bf7ff6812
SHA5124deb61ea7ea3a5cec8fee42e878cc3704375f05ff3c68ae1cc7154885919c2f3952e22a042d716efe4277041f9384203f13308f1e9ce7338139cb4d314424d38
-
C:\Users\Admin\AppData\Roaming\xofegmuvwc.txtMD5
2e458a59025b390fbdf7d3717314b507
SHA1d5a84f501bfa81682ebde5e31a68794140141785
SHA2566b723bd260b53c68c716ef218c78718d3e99ab4d4238a4bd823fd0cd6ec8007b
SHA5122b463bc4ef98264560abad47053549c463fc9ee098c97cd60d58c959ba67f4ddf2ca60856f6564802a9f056740fbedbb6bdc829388c136c13b334563465d1f22
-
memory/1084-60-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmpFilesize
8KB
-
memory/1392-63-0x0000000000000000-mapping.dmp
-
memory/1796-66-0x0000000000000000-mapping.dmp
-
memory/1796-68-0x0000000001B80000-0x0000000001B81000-memory.dmpFilesize
4KB
-
memory/1996-61-0x0000000000000000-mapping.dmp