Analysis
-
max time kernel
167s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:39
Static task
static1
Behavioral task
behavioral1
Sample
JJWord_3.2.1.5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
JJWord_3.2.1.5.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20220812-en
General
-
Target
JJWord_3.2.1.5.exe
-
Size
3.7MB
-
MD5
87e5d52b702ed8af6ecbe28fce18a9ec
-
SHA1
5a23337c481dcca86d21c58e77a487a0e08e81df
-
SHA256
88b4d7207723f7db07602f5c6672221222142fc2abaebdb0d17cb82a5e7439ae
-
SHA512
d9fd753ac744132d51a0cbe05bb6f9f524219446c71efe29072d6d56302b89c27d3bd6d70910834fb7f4d62262c62a4b0d1ab0d0bb64d5d8e517648f441db889
-
SSDEEP
98304:YWwgZA1YX80ET5J3+hyxMM1lI6ual0ogve3V4f+:SgYA7ET5J3+hyx3lfcUr
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
JJWord_3.2.1.5.exepid process 4948 JJWord_3.2.1.5.exe 4948 JJWord_3.2.1.5.exe 4948 JJWord_3.2.1.5.exe 4948 JJWord_3.2.1.5.exe 4948 JJWord_3.2.1.5.exe 4948 JJWord_3.2.1.5.exe 4948 JJWord_3.2.1.5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
JJWord_3.2.1.5.exepid process 4948 JJWord_3.2.1.5.exe 4948 JJWord_3.2.1.5.exe 4948 JJWord_3.2.1.5.exe 4948 JJWord_3.2.1.5.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsgFCC6.tmp\FindProcDLL.dllFilesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
C:\Users\Admin\AppData\Local\Temp\nsgFCC6.tmp\FindProcDLL.dllFilesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
C:\Users\Admin\AppData\Local\Temp\nsgFCC6.tmp\FindProcDLL.dllFilesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
C:\Users\Admin\AppData\Local\Temp\nsgFCC6.tmp\FindProcDLL.dllFilesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
C:\Users\Admin\AppData\Local\Temp\nsgFCC6.tmp\InstallOptions.dllFilesize
14KB
MD50dc0cc7a6d9db685bf05a7e5f3ea4781
SHA15d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA2568e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
SHA512814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
-
C:\Users\Admin\AppData\Local\Temp\nsgFCC6.tmp\InstallOptions.dllFilesize
14KB
MD50dc0cc7a6d9db685bf05a7e5f3ea4781
SHA15d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA2568e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
SHA512814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
-
C:\Users\Admin\AppData\Local\Temp\nsgFCC6.tmp\System.dllFilesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
memory/4948-139-0x00000000032B1000-0x00000000032B3000-memory.dmpFilesize
8KB
-
memory/4948-140-0x0000000002360000-0x0000000002363000-memory.dmpFilesize
12KB