Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    13/12/2021, 15:18

General

  • Target

    SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.js

  • Size

    491KB

  • MD5

    87abfdba2290a31df0d97e91cc4b1195

  • SHA1

    04ccec1a839efb216cfab4c6bf35e25b1b320157

  • SHA256

    556e3aa4f1bdf16c72a2ab22884b935936386f69ca4977a6e815bcc1eb3b9408

  • SHA512

    bcf7c1528ca72669d43d495f5daa21417f757dbd825593cf6589bf9502e3866b7860a807be81a92d9d20dc2dee4ca84bae85dabcddec3a53b83ba336a840aa9c

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • suricata: ET MALWARE STRRAT CnC Checkin

    suricata: ET MALWARE STRRAT CnC Checkin

  • Blocklisted process makes network request 15 IoCs
  • Drops startup file 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\oiCIKHrGSI.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:556
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\etthhdicsg.txt"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1420
      • C:\Program Files\Java\jre7\bin\java.exe
        "C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\etthhdicsg.txt"
        3⤵
        • Drops startup file
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1608
        • C:\Windows\system32\cmd.exe
          cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\etthhdicsg.txt"
          4⤵
            PID:1724
            • C:\Windows\system32\schtasks.exe
              schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\etthhdicsg.txt"
              5⤵
              • Creates scheduled task(s)
              PID:1956
          • C:\Program Files\Java\jre7\bin\java.exe
            "C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\etthhdicsg.txt"
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1088
            • C:\Windows\system32\cmd.exe
              cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:840
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1912
            • C:\Windows\system32\cmd.exe
              cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:528
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1092
            • C:\Windows\system32\cmd.exe
              cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1640
            • C:\Windows\system32\cmd.exe
              cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1716
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1724
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list
      1⤵
        PID:1136

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1088-111-0x0000000002230000-0x00000000024A0000-memory.dmp

              Filesize

              2.4MB

            • memory/1088-149-0x0000000000320000-0x0000000000321000-memory.dmp

              Filesize

              4KB

            • memory/1088-140-0x0000000000320000-0x0000000000321000-memory.dmp

              Filesize

              4KB

            • memory/1088-118-0x0000000000320000-0x0000000000321000-memory.dmp

              Filesize

              4KB

            • memory/1088-112-0x0000000000320000-0x0000000000321000-memory.dmp

              Filesize

              4KB

            • memory/1420-65-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-73-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-80-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-77-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-76-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-71-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-68-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-64-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-82-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-67-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-78-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-74-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-79-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-63-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1420-62-0x0000000002200000-0x0000000002470000-memory.dmp

              Filesize

              2.4MB

            • memory/1420-61-0x0000000002200000-0x0000000002470000-memory.dmp

              Filesize

              2.4MB

            • memory/1420-75-0x0000000000110000-0x0000000000111000-memory.dmp

              Filesize

              4KB

            • memory/1608-91-0x0000000001C50000-0x0000000001C51000-memory.dmp

              Filesize

              4KB

            • memory/1608-90-0x0000000002070000-0x00000000022E0000-memory.dmp

              Filesize

              2.4MB

            • memory/1608-101-0x0000000001C50000-0x0000000001C51000-memory.dmp

              Filesize

              4KB

            • memory/1608-100-0x0000000001C50000-0x0000000001C51000-memory.dmp

              Filesize

              4KB

            • memory/1648-55-0x000007FEFB791000-0x000007FEFB793000-memory.dmp

              Filesize

              8KB