e69b9cff44ad1e37d522510ff33b3db67eeb6bd3b30f0c6d42b8b4764ed2bc42

Analysis

Target
Tax Returns of R28,765.50.js
Size 183KB
Sample210929-mr8wdsefa6
SHA256 e69b9cff44ad1e37d522510ff33b3db67eeb6bd3b30f0c6d42b8b4764ed2bc42
MD5 eb5db8af69661cc81ba371cc96419f84
SHA1 03520b9f08ccd896b77ced8933224b75701b982c
SHA512 4bb1778531d760f830e7502ecc928eb8452530961bb72ec666f4b40934de9afdb70498255c2e7ac9215a31173b72beb51320758cbb7983fbee396b7e388e2d4a
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	820	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	WerFault.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 820	1832	wscript.exe	68
PID 1832 wrote to memory of 820	1832	wscript.exe	68

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Tax Returns of R28,765.50.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\jsbxyhnt.txt"
  2⤵
  PID:820
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 820 -s 356
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2140

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact