Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
23-06-2022 05:56
Static task
static1
Behavioral task
behavioral1
Sample
Pallet Mould MMS Request Order-220622.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Pallet Mould MMS Request Order-220622.js
Resource
win10v2004-20220414-en
General
-
Target
Pallet Mould MMS Request Order-220622.js
-
Size
977KB
-
MD5
327eb3c62ef17abe0d9ff20fad15858c
-
SHA1
bfe3889fd8816fa1a1c48ed7fa5337b80f3c3254
-
SHA256
95cfd578f1acad16fa97d598e87f831076777ee8820daa5d1556be320acf3e51
-
SHA512
5887d40e829f4edf0ca08e9b17f0c69d966245d96d9b6896c1db8eea153561dacf1395aea6075376d14781a43636ff8d13dd493870cbbfee02a24704b7dd97e8
Malware Config
Signatures
-
Blocklisted process makes network request 15 IoCs
Processes:
WScript.exeflow pid process 4 988 WScript.exe 5 988 WScript.exe 6 988 WScript.exe 8 988 WScript.exe 10 988 WScript.exe 11 988 WScript.exe 13 988 WScript.exe 14 988 WScript.exe 15 988 WScript.exe 17 988 WScript.exe 18 988 WScript.exe 19 988 WScript.exe 21 988 WScript.exe 22 988 WScript.exe 23 988 WScript.exe -
Drops startup file 2 IoCs
Processes:
WScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\itROlJiMHh.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\itROlJiMHh.js WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\itROlJiMHh.js\"" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 1012 wrote to memory of 988 1012 wscript.exe WScript.exe PID 1012 wrote to memory of 988 1012 wscript.exe WScript.exe PID 1012 wrote to memory of 988 1012 wscript.exe WScript.exe PID 1012 wrote to memory of 1720 1012 wscript.exe javaw.exe PID 1012 wrote to memory of 1720 1012 wscript.exe javaw.exe PID 1012 wrote to memory of 1720 1012 wscript.exe javaw.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Pallet Mould MMS Request Order-220622.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\itROlJiMHh.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\fuxvnvaaj.txt"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\fuxvnvaaj.txtFilesize
352KB
MD51888a0b250cff2a301d3f614196f6b88
SHA17402aa66aaaaa5b243c525e79f732a80a0df9da6
SHA2563285c766b37048280e668af1d457aaa43ae2a40a890d4afa34582fae92464fe6
SHA512235b288b7f0014c3d88f5308ff3c2e92049dd5cb330f538633eae74d4ff499c939e72d7e0b7324a613fe3f73969b857354258a9065c9ed88459a3095903362ec
-
C:\Users\Admin\AppData\Roaming\itROlJiMHh.jsFilesize
117KB
MD5a78c8f04065fb801394601fdde312a90
SHA1f8b58ed384d1140277d6a56c79f9b9fd516f4a08
SHA256c06656c4ff8f66c07004a7b1af8a232624efc504099f8d800c3980a9adf23c6d
SHA512b5f5ca1385cf16579aba5316980123415dfa30362f1fb083d688ad9986b2d63eaffd1f99b645087735f6359443d6891b62a0b123591495fa88753a1537662829
-
memory/988-55-0x0000000000000000-mapping.dmp
-
memory/1012-54-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmpFilesize
8KB
-
memory/1720-57-0x0000000000000000-mapping.dmp
-
memory/1720-70-0x0000000002180000-0x0000000005180000-memory.dmpFilesize
48.0MB
-
memory/1720-71-0x0000000002180000-0x0000000005180000-memory.dmpFilesize
48.0MB