Analysis
-
max time kernel
142s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-06-2022 15:13
Static task
static1
Behavioral task
behavioral1
Sample
jyahaoabcs.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
jyahaoabcs.js
Resource
win10v2004-20220414-en
General
-
Target
jyahaoabcs.js
-
Size
953KB
-
MD5
b0858d86fb22aa01d7ad40ef5ab0b069
-
SHA1
6c6c7a2f34149a8702d2ae401294291d38c064a0
-
SHA256
0055c6430d720c28a449fd9df4d9fcb440dfec67f3eff217adfd6e0a2fa97bd0
-
SHA512
980423d2379677a469205c1119cdd323ea36331d53aa46eae98c5fedf67be2cae7023e63e14e7ffb1bb40a378ce3f700f6facfd5edb6a14dba531daddaaba8d6
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
WScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yBzacvcZKX.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yBzacvcZKX.js WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\yBzacvcZKX.js\"" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
javaw.exepid process 2040 javaw.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
wscript.exejavaw.execmd.exedescription pid process target process PID 1120 wrote to memory of 1272 1120 wscript.exe WScript.exe PID 1120 wrote to memory of 1272 1120 wscript.exe WScript.exe PID 1120 wrote to memory of 1272 1120 wscript.exe WScript.exe PID 1120 wrote to memory of 2040 1120 wscript.exe javaw.exe PID 1120 wrote to memory of 2040 1120 wscript.exe javaw.exe PID 1120 wrote to memory of 2040 1120 wscript.exe javaw.exe PID 2040 wrote to memory of 852 2040 javaw.exe java.exe PID 2040 wrote to memory of 852 2040 javaw.exe java.exe PID 2040 wrote to memory of 852 2040 javaw.exe java.exe PID 2040 wrote to memory of 872 2040 javaw.exe cmd.exe PID 2040 wrote to memory of 872 2040 javaw.exe cmd.exe PID 2040 wrote to memory of 872 2040 javaw.exe cmd.exe PID 872 wrote to memory of 1080 872 cmd.exe cscript.exe PID 872 wrote to memory of 1080 872 cmd.exe cscript.exe PID 872 wrote to memory of 1080 872 cmd.exe cscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\jyahaoabcs.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\yBzacvcZKX.js"2⤵
- Drops startup file
- Adds Run key to start application
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\sfdyftrokx.txt"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.78788133516512461187632103980904729.class3⤵
-
C:\Windows\system32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5280658648225861446.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5280658648225861446.vbs4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_0.78788133516512461187632103980904729.classFilesize
241KB
MD5781fb531354d6f291f1ccab48da6d39f
SHA19ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA25697d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA5123e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
-
C:\Users\Admin\AppData\Roaming\sfdyftrokx.txtFilesize
479KB
MD50af2ffb0e3a810f556a0eef909a5ecc7
SHA1641fe60bfa8569a0a13dc9279ea1cafb5cb912ad
SHA2569d05feba177ac6b9433f0a28bf9e6ba9828f1621f625f7ca80009a1cf5b5374b
SHA512883f01a0d0c2ed6ada0dd3d2b4548d01b54f6cf4fcfd6a39f9a61511147fefc4ea8ad4392873fd54e4d7c1c04adc01c94bf99447ddfcde925340ae4ea409b1c9
-
C:\Users\Admin\AppData\Roaming\yBzacvcZKX.jsFilesize
24KB
MD59cb94db4ae02bd253f2a41995076f5d2
SHA151ff0dc0516a93a8ac5620ccfa4b0e7750ebaeb1
SHA25616288f415596cee7e80051087859c51cd5f2a44cc0c98b708b78a87f89c0a9ec
SHA512f3277d959dc34dc4d920261de1cdcf82712982d543b7901f5ddfa7f0a793a33670aa1fec23aa7468ade221e275b02cfa948d3d15aa8fe63a3a011d3363ee4161
-
memory/852-85-0x00000000023B0000-0x00000000053B0000-memory.dmpFilesize
48.0MB
-
memory/852-70-0x0000000000000000-mapping.dmp
-
memory/852-83-0x00000000023B0000-0x00000000053B0000-memory.dmpFilesize
48.0MB
-
memory/872-87-0x0000000000000000-mapping.dmp
-
memory/1080-88-0x0000000000000000-mapping.dmp
-
memory/1120-54-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmpFilesize
8KB
-
memory/1272-55-0x0000000000000000-mapping.dmp
-
memory/2040-57-0x0000000000000000-mapping.dmp
-
memory/2040-84-0x0000000002320000-0x0000000005320000-memory.dmpFilesize
48.0MB
-
memory/2040-79-0x0000000002320000-0x0000000005320000-memory.dmpFilesize
48.0MB