2b580e7c81ded1d2770a80ecb93b025f849c7a8d5c7cde1b81b80a5d6505462c

Analysis

max time kernel
89s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2022, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ATOI24587YLKM8900.js
Size 204KB
Sample220810-1z2zpshec2
SHA256 2b580e7c81ded1d2770a80ecb93b025f849c7a8d5c7cde1b81b80a5d6505462c
MD5 104e0ccc4da38bde51e25ee0b6736a29
SHA1 f5eb8a524fb6afa2ef2c5857c5b696e0789859d6
SHA512 0d7c643ec0e1c2ffa00b6d49a56ad35e15a68c1ab7554d5b2cab7ed1ebd1cb23c76a188aac7c3e1721bcef1a287f14bd8783167d834f9ddd4f6f9c33cd2fa2ee
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1936	1416	wscript.exe	82
PID 1416 wrote to memory of 1936	1416	wscript.exe	82

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ATOI24587YLKM8900.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\pplkfdxji.txt"
  2⤵
  - Drops file in Program Files directory
  PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pplkfdxji.txt

Path C:\Users\Admin\AppData\Roaming\pplkfdxji.txt
Size 92KB
SHA256 13c26f392e603e53a69f8d9b280732e4e481ee0bc22cfe3dbbf1e5e157db81ae
MD5 094f4bd8a9e87217164f3ebbc775599c
SHA1 50212b6455a703703ea96f13586a16ee5921dea0
SHA512 fd058581cee7be17219e6b9eb88b907c6daa13bb4e1bcf43e88f0596ad03428b00782c33d14566ea348a841018c26a3a676b135fec2df1838f0a3bfef667e6cd
SSDEEP 1536:Gq/X1AzwP1p9Qh1+jKUct1nGSePsE8T0epLiOjxTxDRheNx6HGvGvxvpiHrAR:GqSzwP1HQujEGfPZ84e9iO9TkNxTvTLK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1936-140-0x0000000002730000-0x0000000003730000-memory.dmp

Download