8aab09c796974a78894eb7f4b542e921b590c9abc153279e644046867942d2f7

Analysis

max time kernel
150s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/03/2023, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MandyPayLoad2023.3.13.js
Size 350KB
Sample230314-fx5mlade88
SHA256 8aab09c796974a78894eb7f4b542e921b590c9abc153279e644046867942d2f7
MD5 b96955c32781565c78e7e1ffab26e3ba
SHA1 1a033f587923637f9e26ef80e516570553f8d54a
SHA512 d6851bb224bc0155fecb77be1c8120e62846ba2d2ae1ff3278f7dae84b5192c23b2e2d1a094b12b40d47971345d3a0e2783a4584126be564003b542108166316
SSDEEP 6144:GQss5sQnVyMgfwtuBjKoyU+QWVV8C1DqezXimWvnzOJNgph3ax59db9TVGWacFQe:NcQnVyFfGEKJnlbt2Nax3g4SVPM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 2032	1396	wscript.exe	28
PID 1396 wrote to memory of 2032	1396	wscript.exe	28
PID 1396 wrote to memory of 2032	1396	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MandyPayLoad2023.3.13.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\vemdizwn.txt"
  2⤵
  PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vemdizwn.txt

Path C:\Users\Admin\AppData\Roaming\vemdizwn.txt
Size 164KB
SHA256 797db82ee459a5bcf044544ab15ea43866073ec5d631bacecaab364d8a9db2b0
MD5 9da3d10ee0f19e51239fe07cdfd97370
SHA1 69efd4a2b068db60b83ee206e1f5bb5e905d6763
SHA512 d5eb9ae551433c57e0dad8e57020a7cf8fa4a51b4aa836b8f3b4c0c0fa6d09ea3cbd903d63845b9f016a132b1a241632319d50bf3d82f0181eea4df40ba7038b
SSDEEP 3072:swddMPvY4mfNEO9H6E5u9T6rkhiO1eo0SOM4rMxtFHv0xFw5+5nW:sZwfucu9THhiO1L0i/FcxFMsW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2032-65-0x0000000000210000-0x0000000000211000-memory.dmp

Download

memory/2032-66-0x0000000000210000-0x0000000000211000-memory.dmp

Download

memory/2032-89-0x0000000000210000-0x0000000000211000-memory.dmp

Download

memory/2032-94-0x0000000000210000-0x0000000000211000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads