Analysis
-
max time kernel
152s -
max time network
184s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-08-2021 05:47
Static task
static1
Behavioral task
behavioral1
Sample
P I09045090979.jpg.js
Resource
win7v20210410
Behavioral task
behavioral2
Sample
P I09045090979.jpg.js
Resource
win10v20210410
General
-
Target
P I09045090979.jpg.js
-
Size
200KB
-
MD5
9a7ad3d3d82e36a33e673af5a6ad66ea
-
SHA1
9b4683b9ff01722e54bca2b88789ff6304978e32
-
SHA256
9fd94aca819af4ae40e78aaebc42c92af94539135ccd50839626a2565106f9e9
-
SHA512
1412efe123cba05e5982a379bf8ee3afcc3fb384dbd0b9efe739d8ecbc30823dd26be1198d71cb594dedeaf2e26e757bb17e67d6b19680e36b2a8ba970df8479
Malware Config
Signatures
-
Blocklisted process makes network request 18 IoCs
Processes:
WScript.exeflow pid process 7 1796 WScript.exe 8 1796 WScript.exe 9 1796 WScript.exe 11 1796 WScript.exe 12 1796 WScript.exe 13 1796 WScript.exe 15 1796 WScript.exe 16 1796 WScript.exe 17 1796 WScript.exe 19 1796 WScript.exe 20 1796 WScript.exe 21 1796 WScript.exe 23 1796 WScript.exe 24 1796 WScript.exe 25 1796 WScript.exe 27 1796 WScript.exe 28 1796 WScript.exe 29 1796 WScript.exe -
Drops startup file 2 IoCs
Processes:
WScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YphdXIgjJq.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YphdXIgjJq.js WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\YphdXIgjJq.js\"" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1284 1740 WerFault.exe javaw.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 1284 WerFault.exe 1284 WerFault.exe 1284 WerFault.exe 1284 WerFault.exe 1284 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1284 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1284 WerFault.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
wscript.exejavaw.exedescription pid process target process PID 1860 wrote to memory of 1796 1860 wscript.exe WScript.exe PID 1860 wrote to memory of 1796 1860 wscript.exe WScript.exe PID 1860 wrote to memory of 1796 1860 wscript.exe WScript.exe PID 1860 wrote to memory of 1740 1860 wscript.exe javaw.exe PID 1860 wrote to memory of 1740 1860 wscript.exe javaw.exe PID 1860 wrote to memory of 1740 1860 wscript.exe javaw.exe PID 1740 wrote to memory of 1284 1740 javaw.exe WerFault.exe PID 1740 wrote to memory of 1284 1740 javaw.exe WerFault.exe PID 1740 wrote to memory of 1284 1740 javaw.exe WerFault.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\P I09045090979.jpg.js"1⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\YphdXIgjJq.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1796 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\lbhpihivyo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1740 -s 1403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1284
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\YphdXIgjJq.jsMD5
fa16c7f592354e070b5c0fb6cdfc3272
SHA16c3d396632bfb1d78777d921dfc9feada2722225
SHA2565207094802b5e244704fe007c0a86485f08eead9cda6c6776b8b7972c3af8e68
SHA512a9746fd10a469f2f8ead79338fb2ec2e6a50a7f27f66de547baeac6951726f680b233d13149296196b188d483ed809bac40fa95843b62385a3583c89a1a5ea3c
-
C:\Users\Admin\AppData\Roaming\lbhpihivyo.txtMD5
2e458a59025b390fbdf7d3717314b507
SHA1d5a84f501bfa81682ebde5e31a68794140141785
SHA2566b723bd260b53c68c716ef218c78718d3e99ab4d4238a4bd823fd0cd6ec8007b
SHA5122b463bc4ef98264560abad47053549c463fc9ee098c97cd60d58c959ba67f4ddf2ca60856f6564802a9f056740fbedbb6bdc829388c136c13b334563465d1f22
-
memory/1284-66-0x0000000000000000-mapping.dmp
-
memory/1284-68-0x0000000001C20000-0x0000000001C21000-memory.dmpFilesize
4KB
-
memory/1740-62-0x0000000000000000-mapping.dmp
-
memory/1796-61-0x0000000000000000-mapping.dmp
-
memory/1860-60-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmpFilesize
8KB