Analysis

  • max time kernel
    115s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    13/12/2021, 15:19

General

  • Target

    Request_For_Quotation.js

  • Size

    182KB

  • MD5

    b6dfbc43cb551d1c52da19a0709fb5ad

  • SHA1

    c5b2c6093e12a8797d587533f2ab7e56622e8de5

  • SHA256

    423a355fb8233f9681ad718fb887df922942594b6ada5e926b1ecf4e67b6cd71

  • SHA512

    8ab41fadf08ceeb49f4f2fbeb33bbe0b0c5150daf07b2ab1d6bba38ee1bbe7baa8a7051cd9bc27372191389b850feac7e70878fda4f181d75e723c8422ea7a0b

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Request_For_Quotation.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\iwcun.txt"
      2⤵
      • Drops file in Program Files directory
      PID:3684

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3684-122-0x0000000002FE0000-0x0000000002FF0000-memory.dmp

          Filesize

          64KB

        • memory/3684-117-0x0000000002D70000-0x0000000002FE0000-memory.dmp

          Filesize

          2.4MB

        • memory/3684-118-0x0000000002D70000-0x0000000002FE0000-memory.dmp

          Filesize

          2.4MB

        • memory/3684-119-0x0000000000D90000-0x0000000000D91000-memory.dmp

          Filesize

          4KB

        • memory/3684-121-0x0000000000D90000-0x0000000000D91000-memory.dmp

          Filesize

          4KB

        • memory/3684-124-0x0000000003000000-0x0000000003010000-memory.dmp

          Filesize

          64KB

        • memory/3684-123-0x0000000002FF0000-0x0000000003000000-memory.dmp

          Filesize

          64KB

        • memory/3684-125-0x0000000000D90000-0x0000000000D91000-memory.dmp

          Filesize

          4KB

        • memory/3684-127-0x0000000003020000-0x0000000003030000-memory.dmp

          Filesize

          64KB

        • memory/3684-126-0x0000000003010000-0x0000000003020000-memory.dmp

          Filesize

          64KB

        • memory/3684-129-0x0000000003040000-0x0000000003050000-memory.dmp

          Filesize

          64KB

        • memory/3684-128-0x0000000003030000-0x0000000003040000-memory.dmp

          Filesize

          64KB