4ac9e3bd0c9ffb1ef7e5c656a7fcf9b3a7de2a5e9c5595176d8770d0648da469

Analysis

max time kernel
19s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Request For Quotation.js
Size 182KB
Sample220720-khkfbsdfd5
SHA256 4ac9e3bd0c9ffb1ef7e5c656a7fcf9b3a7de2a5e9c5595176d8770d0648da469
MD5 7542be6c09b77bafb1f02ca0766e8748
SHA1 7c4d8a113db7e7d2a3edb7a34ff9a4a9cb9c391a
SHA512 6573fd08be25fd782a58d7677bea796ffd1effa1bee0ff22db716843919b12f33b1d7ee3e865173df79563bead153d5ec170548750f3797c0023814237e93cbe
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000_Classes\Local Settings	wscript.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1580	2640	wscript.exe	79
PID 2640 wrote to memory of 1580	2640	wscript.exe	79
PID 2640 wrote to memory of 1816	2640	wscript.exe	80
PID 2640 wrote to memory of 1816	2640	wscript.exe	80

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Request For Quotation.js"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\xwzxoFPAGF.js"
  2⤵
  PID:1580
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\bmpntao.txt"
  2⤵
  PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bmpntao.txt

Path C:\Users\Admin\AppData\Roaming\bmpntao.txt
Size 92KB
SHA256 20ad6197b8d0b6b2764f90ef38bace3e230cb2878db9a30778db0e4ef042a039
MD5 391907cc91179ada8c93dfb70cf2fa56
SHA1 da55acbf6aafe2f376bf4ebd3ff8fbf99cf4966d
SHA512 931c419c6fff67cc0973eaa67c771aafa573ad5875b1db93ed4ec52e1f20f7e567a0f7c44d916de1d8e77407fe83eb2418fc9c0ba457bd05ef1f742bc4ed0afc
SSDEEP 1536:Vv/O1A/qP169QQ1+j93c28nGSPPsFNE0TpL5GjYTAa4he3sTHGvzvxepfHr5I:Vvb/qP1WQ1jEG2PANFT95GkTb3sSvOLq
MD5 SHA1 SHA512 SSDEEP

Submit Download

xwzxoFPAGF.js

Path C:\Users\Admin\AppData\Roaming\xwzxoFPAGF.js
Size 857B
SHA256 ad40fd8d10016754ca4ccad608195fa4931b6d5b9379bcee183fd7b138f41c48
MD5 e3497f9024abb6c68e4322a2e9752e16
SHA1 20db9d07be12dd43d87ef10ceed809a289944744
SHA512 a73cbc44f3aff81c330373b408cd7094babb35092825e7df8946f01ec8261fabbfaab082d8b05e8b0fbed6644f406897596ffd695b7f417672ad23c0365fa0de
MD5 SHA1 SHA512

Submit Download

memory/1816-143-0x00000000031D0000-0x00000000041D0000-memory.dmp

Download

memory/1816-158-0x00000000031D0000-0x00000000041D0000-memory.dmp

Download

memory/1816-169-0x00000000031D0000-0x00000000041D0000-memory.dmp

Download

memory/1816-170-0x00000000031D0000-0x00000000041D0000-memory.dmp

Download

memory/1816-171-0x00000000031D0000-0x00000000041D0000-memory.dmp

Download

memory/1816-172-0x00000000031D0000-0x00000000041D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads