Overview

overview

10

Static

static

Quotation Request.js

windows7_x64

10

Quotation Request.js

windows10_x64

4

Analysis

  • max time kernel
    110s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    26/11/2021, 17:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Quotation Request.js
  • Size 182KB
  • Sample211126-vkpsyadfcr
  • SHA256 636cb98f6293e4bebf2cc5ec0bef87f081dd9002ebbc26f0f0253ac7cfb0cee2
  • MD5 SHA1 SHA512
Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quotation Request.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\hkrqllbv.txt"
      2⤵
      • Drops file in Program Files directory
      PID:2168

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/2168-117-0x00000000025C0000-0x0000000002830000-memory.dmp
        Download

        memory/2168-118-0x00000000025C0000-0x0000000002830000-memory.dmp
        Download

        memory/2168-119-0x00000000001B0000-0x00000000001B1000-memory.dmp
        Download