3c7c07da80cbf131e4366b6804623120fecf73052bf5d9913ba86d84b1c765d8

Analysis

max time kernel
63s
max time network
51s
platform
windows7_x64
resource
win7-20220414-en
submitted
14/07/2022, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quotation.js
Size 210KB
Sample220714-j55jcaebdn
SHA256 3c7c07da80cbf131e4366b6804623120fecf73052bf5d9913ba86d84b1c765d8
MD5 36747d3b6dac99742ce843af69d364a7
SHA1 f3ef443e220ca4836edf5e8095f534544d36987d
SHA512 d5c68725467ed78a73b6128aa5924501aa6cefd318dd2f691f09b2f85f31beff1916d91d16002fafa6446217087be2b41bc9d622c2a4b436156889570525050d
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1728	1692	wscript.exe	26
PID 1692 wrote to memory of 1728	1692	wscript.exe	26
PID 1692 wrote to memory of 1728	1692	wscript.exe	26
PID 1728 wrote to memory of 1868	1728	javaw.exe	27
PID 1728 wrote to memory of 1868	1728	javaw.exe	27
PID 1728 wrote to memory of 1868	1728	javaw.exe	27

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Quotation.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\mkbtldgjom.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Program Files\Java\jre7\bin\java.exe
    "C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\mkbtldgjom.txt"
    3⤵
    PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mkbtldgjom.txt

Path C:\Users\Admin\AppData\Roaming\mkbtldgjom.txt
Size 92KB
SHA256 20ad6197b8d0b6b2764f90ef38bace3e230cb2878db9a30778db0e4ef042a039
MD5 391907cc91179ada8c93dfb70cf2fa56
SHA1 da55acbf6aafe2f376bf4ebd3ff8fbf99cf4966d
SHA512 931c419c6fff67cc0973eaa67c771aafa573ad5875b1db93ed4ec52e1f20f7e567a0f7c44d916de1d8e77407fe83eb2418fc9c0ba457bd05ef1f742bc4ed0afc
SSDEEP 1536:Vv/O1A/qP169QQ1+j93c28nGSPPsFNE0TpL5GjYTAa4he3sTHGvzvxepfHr5I:Vvb/qP1WQ1jEG2PANFT95GkTb3sSvOLq
MD5 SHA1 SHA512 SSDEEP

Submit Download

mkbtldgjom.txt

Path C:\Users\Admin\mkbtldgjom.txt
Size 92KB
SHA256 20ad6197b8d0b6b2764f90ef38bace3e230cb2878db9a30778db0e4ef042a039
MD5 391907cc91179ada8c93dfb70cf2fa56
SHA1 da55acbf6aafe2f376bf4ebd3ff8fbf99cf4966d
SHA512 931c419c6fff67cc0973eaa67c771aafa573ad5875b1db93ed4ec52e1f20f7e567a0f7c44d916de1d8e77407fe83eb2418fc9c0ba457bd05ef1f742bc4ed0afc
SSDEEP 1536:Vv/O1A/qP169QQ1+j93c28nGSPPsFNE0TpL5GjYTAa4he3sTHGvzvxepfHr5I:Vvb/qP1WQ1jEG2PANFT95GkTb3sSvOLq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1692-54-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Download

memory/1728-62-0x00000000021E0000-0x00000000051E0000-memory.dmp

Download

memory/1868-80-0x0000000002120000-0x0000000005120000-memory.dmp

Download

memory/1868-81-0x0000000002120000-0x0000000005120000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads