Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-08-2021 05:47
Static task
static1
Behavioral task
behavioral1
Sample
P I09045090979.jpg.js
Resource
win7v20210410
Behavioral task
behavioral2
Sample
P I09045090979.jpg.js
Resource
win10v20210410
General
-
Target
P I09045090979.jpg.js
-
Size
200KB
-
MD5
9a7ad3d3d82e36a33e673af5a6ad66ea
-
SHA1
9b4683b9ff01722e54bca2b88789ff6304978e32
-
SHA256
9fd94aca819af4ae40e78aaebc42c92af94539135ccd50839626a2565106f9e9
-
SHA512
1412efe123cba05e5982a379bf8ee3afcc3fb384dbd0b9efe739d8ecbc30823dd26be1198d71cb594dedeaf2e26e757bb17e67d6b19680e36b2a8ba970df8479
Malware Config
Signatures
-
Blocklisted process makes network request 18 IoCs
Processes:
WScript.exeflow pid process 8 1320 WScript.exe 17 1320 WScript.exe 20 1320 WScript.exe 21 1320 WScript.exe 22 1320 WScript.exe 24 1320 WScript.exe 25 1320 WScript.exe 26 1320 WScript.exe 27 1320 WScript.exe 28 1320 WScript.exe 29 1320 WScript.exe 30 1320 WScript.exe 31 1320 WScript.exe 32 1320 WScript.exe 33 1320 WScript.exe 34 1320 WScript.exe 35 1320 WScript.exe 36 1320 WScript.exe -
Drops startup file 2 IoCs
Processes:
WScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YphdXIgjJq.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YphdXIgjJq.js WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\YphdXIgjJq.js\"" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2868 1760 WerFault.exe javaw.exe -
Modifies registry class 1 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings wscript.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe 2868 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 2868 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.exedescription pid process target process PID 3988 wrote to memory of 1320 3988 wscript.exe WScript.exe PID 3988 wrote to memory of 1320 3988 wscript.exe WScript.exe PID 3988 wrote to memory of 1760 3988 wscript.exe javaw.exe PID 3988 wrote to memory of 1760 3988 wscript.exe javaw.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\P I09045090979.jpg.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\YphdXIgjJq.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1320 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\udvlnwqno.txt"2⤵PID:1760
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1760 -s 3523⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\YphdXIgjJq.jsMD5
fa16c7f592354e070b5c0fb6cdfc3272
SHA16c3d396632bfb1d78777d921dfc9feada2722225
SHA2565207094802b5e244704fe007c0a86485f08eead9cda6c6776b8b7972c3af8e68
SHA512a9746fd10a469f2f8ead79338fb2ec2e6a50a7f27f66de547baeac6951726f680b233d13149296196b188d483ed809bac40fa95843b62385a3583c89a1a5ea3c
-
C:\Users\Admin\AppData\Roaming\udvlnwqno.txtMD5
2e458a59025b390fbdf7d3717314b507
SHA1d5a84f501bfa81682ebde5e31a68794140141785
SHA2566b723bd260b53c68c716ef218c78718d3e99ab4d4238a4bd823fd0cd6ec8007b
SHA5122b463bc4ef98264560abad47053549c463fc9ee098c97cd60d58c959ba67f4ddf2ca60856f6564802a9f056740fbedbb6bdc829388c136c13b334563465d1f22
-
memory/1320-114-0x0000000000000000-mapping.dmp
-
memory/1760-116-0x0000000000000000-mapping.dmp