79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10

General
Target

79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe

Filesize

4MB

Completed

25-11-2021 12:41

Score
8/10
MD5

fe1de0acb3aa75f88f61a784288a32d1

SHA1

d973f591f56c3d53aac4e2da4a3eede185c910d9

SHA256

79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10

Malware Config
Signatures 7

Filter: none

Discovery
  • Executes dropped EXE
    79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpjskit.exe

    Reported IOCs

    pidprocess
    106079ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    220079ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    420jskit.exe
  • Loads dropped DLL
    jskit.exe

    Reported IOCs

    pidprocess
    420jskit.exe
  • HTTP links in PDF interactive object

    Description

    Detects HTTP links in interactive objects within PDF files.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/files/0x000400000001abbd-133.datpdf_with_link_action
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious behavior: EnumeratesProcesses
    79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp

    Reported IOCs

    pidprocess
    220079ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    220079ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
  • Suspicious use of FindShellTrayWindow
    79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp

    Reported IOCs

    pidprocess
    220079ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
  • Suspicious use of WriteProcessMemory
    79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2644 wrote to memory of 1060264479ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    PID 2644 wrote to memory of 1060264479ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    PID 2644 wrote to memory of 1060264479ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    PID 1060 wrote to memory of 1036106079ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe
    PID 1060 wrote to memory of 1036106079ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe
    PID 1060 wrote to memory of 1036106079ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe
    PID 1036 wrote to memory of 2200103679ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    PID 1036 wrote to memory of 2200103679ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    PID 1036 wrote to memory of 2200103679ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    PID 2200 wrote to memory of 420220079ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpjskit.exe
    PID 2200 wrote to memory of 420220079ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpjskit.exe
    PID 2200 wrote to memory of 420220079ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpjskit.exe
Processes 5
  • C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe
    "C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe"
    Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\is-976RH.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-976RH.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp" /SL5="$50054,4018938,831488,C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe"
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe
        "C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe" /VERYSILENT
        Suspicious use of WriteProcessMemory
        PID:1036
        • C:\Users\Admin\AppData\Local\Temp\is-1JVN4.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-1JVN4.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp" /SL5="$40120,4018938,831488,C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe" /VERYSILENT
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of FindShellTrayWindow
          Suspicious use of WriteProcessMemory
          PID:2200
          • C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
            "C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe"
            Executes dropped EXE
            Loads dropped DLL
            PID:420
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Local\Temp\is-1JVN4.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp

                          MD5

                          eb8e24c85edf254cf3f2c1344842b55f

                          SHA1

                          2da756889e7e93b4019bb91ff74cd06866a4ec86

                          SHA256

                          e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d

                          SHA512

                          e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61

                        • C:\Users\Admin\AppData\Local\Temp\is-976RH.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp

                          MD5

                          eb8e24c85edf254cf3f2c1344842b55f

                          SHA1

                          2da756889e7e93b4019bb91ff74cd06866a4ec86

                          SHA256

                          e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d

                          SHA512

                          e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61

                        • C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe

                          MD5

                          81acde2ff13a5f79e0d172f3af07d7c0

                          SHA1

                          a07ce9830d50d2c3d94e7df41de032b04fe641d2

                          SHA256

                          c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

                          SHA512

                          9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

                        • C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe

                          MD5

                          81acde2ff13a5f79e0d172f3af07d7c0

                          SHA1

                          a07ce9830d50d2c3d94e7df41de032b04fe641d2

                          SHA256

                          c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

                          SHA512

                          9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

                        • C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\libvorbisenc-2.dll

                          MD5

                          958de7dd326bd45460ecb5082064df4c

                          SHA1

                          42e0da2a5c761641cfa2ff8d57ea21a3325f7606

                          SHA256

                          f89d307fa7c880e72b2f3b5827d755943f1c7ad3a98683a22de721f1fce2e38c

                          SHA512

                          dfe4d1a7c73a0ccfe505501bf7b41976616c3db61b8f44d0dda5537e1321fdc02ad9963c0e0e901020c91b6803782faf195ccdc687d9e4bd2be95c1afb78f894

                        • C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\manual.pdf

                          MD5

                          bb126fef59e31540e493af1999478323

                          SHA1

                          2ee5422524e09b45c0bd0d7764c83febfa0e6ee7

                          SHA256

                          9c082fbbd7aaddf6eff01b1cc890bd9ed1348cb59278529a25119dbdcc5c1d15

                          SHA512

                          501c8c0088cec24ae33d21ffe9fa876cf1cb0cfe0f0b4b59860a32639c210fbfaa5babf79bed10020da85a7dd10c0351cfe61fcf305d65d665b6bdd5c918d32f

                        • \Users\Admin\AppData\Roaming\PhantomJS WebKit\libvorbisenc-2.dll

                          MD5

                          958de7dd326bd45460ecb5082064df4c

                          SHA1

                          42e0da2a5c761641cfa2ff8d57ea21a3325f7606

                          SHA256

                          f89d307fa7c880e72b2f3b5827d755943f1c7ad3a98683a22de721f1fce2e38c

                          SHA512

                          dfe4d1a7c73a0ccfe505501bf7b41976616c3db61b8f44d0dda5537e1321fdc02ad9963c0e0e901020c91b6803782faf195ccdc687d9e4bd2be95c1afb78f894

                        • memory/420-128-0x0000000000000000-mapping.dmp

                        • memory/1036-121-0x0000000000000000-mapping.dmp

                        • memory/1036-126-0x0000000000400000-0x00000000004D8000-memory.dmp

                        • memory/1060-120-0x0000000000720000-0x00000000007CE000-memory.dmp

                        • memory/1060-118-0x0000000000000000-mapping.dmp

                        • memory/2200-127-0x0000000000B60000-0x0000000000B61000-memory.dmp

                        • memory/2200-124-0x0000000000000000-mapping.dmp

                        • memory/2644-117-0x0000000000400000-0x00000000004D8000-memory.dmp