Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21/01/2022, 14:24
Static task
static1
Behavioral task
behavioral1
Sample
Order confirmation.jar
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Order confirmation.jar
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
Order confirmation.jar
-
Size
187KB
-
MD5
9b888e0d179f1079bab199bf682c69d2
-
SHA1
55632e020598c5511d3c361fe2e3c483af39b0ba
-
SHA256
febb815216146ce5b082e909f7ee36a07f2692201b36671fa0f3c73eb7cd407d
-
SHA512
684ef507db352bde9942501ef9f8fdb72be541724d10bda4c7f9b6a4c28eace345cd9078e7b27bf09d06c7babd786d04a275fc96b3f54e4d98f70e8f9a1ffbd8
Malware Config
Signatures
-
Blocklisted process makes network request 9 IoCs
flow pid Process 5 364 WScript.exe 6 364 WScript.exe 13 364 WScript.exe 17 364 WScript.exe 18 364 WScript.exe 19 364 WScript.exe 24 364 WScript.exe 27 364 WScript.exe 28 364 WScript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YSCicdEDwo.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YSCicdEDwo.js WScript.exe -
Loads dropped DLL 2 IoCs
pid Process 1736 java.exe 1056 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\00FAYTSXGU = "\"C:\\Users\\Admin\\AppData\\Roaming\\YSCicdEDwo.js\"" WScript.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 964 WMIC.exe Token: SeSecurityPrivilege 964 WMIC.exe Token: SeTakeOwnershipPrivilege 964 WMIC.exe Token: SeLoadDriverPrivilege 964 WMIC.exe Token: SeSystemProfilePrivilege 964 WMIC.exe Token: SeSystemtimePrivilege 964 WMIC.exe Token: SeProfSingleProcessPrivilege 964 WMIC.exe Token: SeIncBasePriorityPrivilege 964 WMIC.exe Token: SeCreatePagefilePrivilege 964 WMIC.exe Token: SeBackupPrivilege 964 WMIC.exe Token: SeRestorePrivilege 964 WMIC.exe Token: SeShutdownPrivilege 964 WMIC.exe Token: SeDebugPrivilege 964 WMIC.exe Token: SeSystemEnvironmentPrivilege 964 WMIC.exe Token: SeRemoteShutdownPrivilege 964 WMIC.exe Token: SeUndockPrivilege 964 WMIC.exe Token: SeManageVolumePrivilege 964 WMIC.exe Token: 33 964 WMIC.exe Token: 34 964 WMIC.exe Token: 35 964 WMIC.exe Token: SeIncreaseQuotaPrivilege 964 WMIC.exe Token: SeSecurityPrivilege 964 WMIC.exe Token: SeTakeOwnershipPrivilege 964 WMIC.exe Token: SeLoadDriverPrivilege 964 WMIC.exe Token: SeSystemProfilePrivilege 964 WMIC.exe Token: SeSystemtimePrivilege 964 WMIC.exe Token: SeProfSingleProcessPrivilege 964 WMIC.exe Token: SeIncBasePriorityPrivilege 964 WMIC.exe Token: SeCreatePagefilePrivilege 964 WMIC.exe Token: SeBackupPrivilege 964 WMIC.exe Token: SeRestorePrivilege 964 WMIC.exe Token: SeShutdownPrivilege 964 WMIC.exe Token: SeDebugPrivilege 964 WMIC.exe Token: SeSystemEnvironmentPrivilege 964 WMIC.exe Token: SeRemoteShutdownPrivilege 964 WMIC.exe Token: SeUndockPrivilege 964 WMIC.exe Token: SeManageVolumePrivilege 964 WMIC.exe Token: 33 964 WMIC.exe Token: 34 964 WMIC.exe Token: 35 964 WMIC.exe Token: SeIncreaseQuotaPrivilege 1820 WMIC.exe Token: SeSecurityPrivilege 1820 WMIC.exe Token: SeTakeOwnershipPrivilege 1820 WMIC.exe Token: SeLoadDriverPrivilege 1820 WMIC.exe Token: SeSystemProfilePrivilege 1820 WMIC.exe Token: SeSystemtimePrivilege 1820 WMIC.exe Token: SeProfSingleProcessPrivilege 1820 WMIC.exe Token: SeIncBasePriorityPrivilege 1820 WMIC.exe Token: SeCreatePagefilePrivilege 1820 WMIC.exe Token: SeBackupPrivilege 1820 WMIC.exe Token: SeRestorePrivilege 1820 WMIC.exe Token: SeShutdownPrivilege 1820 WMIC.exe Token: SeDebugPrivilege 1820 WMIC.exe Token: SeSystemEnvironmentPrivilege 1820 WMIC.exe Token: SeRemoteShutdownPrivilege 1820 WMIC.exe Token: SeUndockPrivilege 1820 WMIC.exe Token: SeManageVolumePrivilege 1820 WMIC.exe Token: 33 1820 WMIC.exe Token: 34 1820 WMIC.exe Token: 35 1820 WMIC.exe Token: SeIncreaseQuotaPrivilege 1820 WMIC.exe Token: SeSecurityPrivilege 1820 WMIC.exe Token: SeTakeOwnershipPrivilege 1820 WMIC.exe Token: SeLoadDriverPrivilege 1820 WMIC.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 740 wrote to memory of 1488 740 java.exe 28 PID 740 wrote to memory of 1488 740 java.exe 28 PID 740 wrote to memory of 1488 740 java.exe 28 PID 1488 wrote to memory of 364 1488 wscript.exe 29 PID 1488 wrote to memory of 364 1488 wscript.exe 29 PID 1488 wrote to memory of 364 1488 wscript.exe 29 PID 1488 wrote to memory of 2008 1488 wscript.exe 30 PID 1488 wrote to memory of 2008 1488 wscript.exe 30 PID 1488 wrote to memory of 2008 1488 wscript.exe 30 PID 2008 wrote to memory of 1736 2008 javaw.exe 36 PID 2008 wrote to memory of 1736 2008 javaw.exe 36 PID 2008 wrote to memory of 1736 2008 javaw.exe 36 PID 1736 wrote to memory of 1056 1736 java.exe 39 PID 1736 wrote to memory of 1056 1736 java.exe 39 PID 1736 wrote to memory of 1056 1736 java.exe 39 PID 1056 wrote to memory of 540 1056 java.exe 42 PID 1056 wrote to memory of 540 1056 java.exe 42 PID 1056 wrote to memory of 540 1056 java.exe 42 PID 540 wrote to memory of 964 540 cmd.exe 44 PID 540 wrote to memory of 964 540 cmd.exe 44 PID 540 wrote to memory of 964 540 cmd.exe 44 PID 1056 wrote to memory of 1092 1056 java.exe 45 PID 1056 wrote to memory of 1092 1056 java.exe 45 PID 1056 wrote to memory of 1092 1056 java.exe 45 PID 1092 wrote to memory of 1820 1092 cmd.exe 47 PID 1092 wrote to memory of 1820 1092 cmd.exe 47 PID 1092 wrote to memory of 1820 1092 cmd.exe 47 PID 1056 wrote to memory of 984 1056 java.exe 48 PID 1056 wrote to memory of 984 1056 java.exe 48 PID 1056 wrote to memory of 984 1056 java.exe 48 PID 984 wrote to memory of 1460 984 cmd.exe 50 PID 984 wrote to memory of 1460 984 cmd.exe 50 PID 984 wrote to memory of 1460 984 cmd.exe 50 PID 1056 wrote to memory of 1160 1056 java.exe 51 PID 1056 wrote to memory of 1160 1056 java.exe 51 PID 1056 wrote to memory of 1160 1056 java.exe 51
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Order confirmation.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\system32\wscript.exewscript C:\Users\Admin\_output.js2⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\YSCicdEDwo.js"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:364
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\hrrtmf.txt"3⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\hrrtmf.txt"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\hrrtmf.txt"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"6⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list7⤵
- Suspicious use of AdjustPrivilegeToken
PID:964
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"6⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"6⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list7⤵PID:1460
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"6⤵PID:1160
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list7⤵PID:1752
-
-
-
-
-
-