2ee2c07468fbd918a5d6be42c2950be67f33932ddfc072fa1097cff11ecee81d

Analysis

max time kernel
86s
max time network
122s
platform
windows10_x64
resource
win10v20210408
submitted
28-09-2021 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase Order.js
Size

181KB
MD5

340c38c80f5e5de9e9a9a4e51a21fb0c
SHA1

61bc08a3c29f98740133ddbf39db97cbfad33ee9
SHA256

2ee2c07468fbd918a5d6be42c2950be67f33932ddfc072fa1097cff11ecee81d
SHA512

e175e286082fa3018e318387fd5e4acc6c06549a72572bd1323ee1e99f74222ce5826ac731947e9ca4460f7a440e799ca402f72a194962016e6fd6e04c7aeca8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3568 688 WerFault.exe javaw.exe

pid	pid_target	process	target process
3568	688	WerFault.exe	javaw.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3568 WerFault.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description pid process target process

PID 4024 wrote to memory of 688 4024 wscript.exe javaw.exe
PID 4024 wrote to memory of 688 4024 wscript.exe javaw.exe

description	pid	process
Token: SeDebugPrivilege	3568	WerFault.exe

description	pid	process	target process
PID 4024 wrote to memory of 688	4024	wscript.exe	javaw.exe
PID 4024 wrote to memory of 688	4024	wscript.exe	javaw.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Order.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4024

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\bmjzd.txt"
2⤵
PID:688

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 688 -s 368
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\bmjzd.txt
MD5
5155453d759e49880d32caa54962acb0

SHA1
5f0b3395920fc56a9297866eb32590ff65cf28d2

SHA256
28daccdadfd5999b6463f6d1ed0d4da8f369f9d84d9046dd453b1ac78c5b6af5

SHA512
f8c97db63f996b5200ce3b1fcdfc26aff03f64714f52f4cf61fed87425347e4642d07e42847a187c2c5c53b8a4cd4c312326664f32ae8f43694ff867f5dd543e

Download Submit
memory/688-114-0x0000000000000000-mapping.dmp

Download