Analysis

  • max time kernel
    158s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/03/2023, 14:46

General

  • Target

    e95bd278a62238cbee597f5426d992e5d8127e87890fdb30e992c21e4b825272.js

  • Size

    435KB

  • MD5

    20f9cc5642a27dc60fc83d409cba7dbf

  • SHA1

    1b372bf14de42e8c92a9a65595184580becd9205

  • SHA256

    e95bd278a62238cbee597f5426d992e5d8127e87890fdb30e992c21e4b825272

  • SHA512

    71f209d20494a7a81411ab01f897d469d9310bbd50b67b29a3f11d5214125392c82deeea18732709345da2a36c2e856df07d0cb7d8093792069fd145d1b2a23d

  • SSDEEP

    6144:GQ9ysU+dlJWsBosmcehlTzq5D1NwcMFkWxOTtJADySaTnS/XIBU6nDobD0cj:Nw+NWsQBTAEclW0+DSn8IpYh

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\e95bd278a62238cbee597f5426d992e5d8127e87890fdb30e992c21e4b825272.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\wkewogjrdf.txt"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:604
      • C:\Program Files\Java\jre1.8.0_66\bin\java.exe
        "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\wkewogjrdf.txt"
        3⤵
        • Drops startup file
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Windows\SYSTEM32\cmd.exe
          cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\wkewogjrdf.txt"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4332
          • C:\Windows\system32\schtasks.exe
            schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\wkewogjrdf.txt"
            5⤵
            • Creates scheduled task(s)
            PID:4200
        • C:\Program Files\Java\jre1.8.0_66\bin\java.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\wkewogjrdf.txt"
          4⤵
          • Loads dropped DLL
          PID:1784

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

          Filesize

          50B

          MD5

          da57bfbc168af102dbcab3c5b8e74823

          SHA1

          fda66d20292dd5386eeefeb979d52154394e8b6f

          SHA256

          522ee2b29f15783268219661fd5b9e053d1c86b9f9d01ba4967d979eb51c65d9

          SHA512

          154677402e5665666cc2c8161965f37549b9a24f01d519f4f1012b66c99f67b9025fb9e1fd5153c500f2c0d6c953c4a078b223e0e18e00c61d5c72d4d269d9ac

        • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

          Filesize

          50B

          MD5

          8d688594607f8765cf96482467b97b36

          SHA1

          8eb0c9b27163fb5565d399a5f612adde6eadef91

          SHA256

          5d19aa3b5370444df2cdc2b5e58f3336912ea428bc300178200f6b0bc5795fc9

          SHA512

          8bf9c08e5d8724817cbca1d109de6d25c91386adc683441dc859c002fc28b01b67ba19ae7c6814e5d73a8b0ea2f824753f72307830529cb022d8461cf8081487

        • C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna1793868100261894377.dll

          Filesize

          241KB

          MD5

          e02979ecd43bcc9061eb2b494ab5af50

          SHA1

          3122ac0e751660f646c73b10c4f79685aa65c545

          SHA256

          a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a

          SHA512

          1e6f7dcb6a557c9b896412a48dd017c16f7a52fa2b9ab513593c9ecd118e86083979821ca7a3e2f098ee349200c823c759cec6599740dd391cb5f354dc29b372

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-144354903-2550862337-1367551827-1000\83aa4cc77f591dfc2374580bbd95f6ba_76cff8be-8f86-4613-9a47-5d5870acb67c

          Filesize

          45B

          MD5

          c8366ae350e7019aefc9d1e6e6a498c6

          SHA1

          5731d8a3e6568a5f2dfbbc87e3db9637df280b61

          SHA256

          11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

          SHA512

          33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkewogjrdf.txt

          Filesize

          209KB

          MD5

          c4d205a56ff6971ca58460cd4fe9f7db

          SHA1

          20aaae5dc2f1cbc7f3bc281fd91b57d51a2c7d80

          SHA256

          e8533d9ed906d969b147d6b444234bac03d4bc6d120fe53b23747029b48b5fa5

          SHA512

          c493394b1f4b9dee1a3445da803975a5000758c98ba781104bbaf9790097af87cfe8ffacc86cef4dc2907a741dde3bc9f2e4ccf04dbb4a0963eb0fd73215b169

        • C:\Users\Admin\AppData\Roaming\lib\jna-5.5.0.jar

          Filesize

          1.4MB

          MD5

          acfb5b5fd9ee10bf69497792fd469f85

          SHA1

          0e0845217c4907822403912ad6828d8e0b256208

          SHA256

          b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e

          SHA512

          e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa

        • C:\Users\Admin\AppData\Roaming\lib\jna-platform-5.5.0.jar

          Filesize

          2.6MB

          MD5

          2f4a99c2758e72ee2b59a73586a2322f

          SHA1

          af38e7c4d0fc73c23ecd785443705bfdee5b90bf

          SHA256

          24d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5

          SHA512

          b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494

        • C:\Users\Admin\AppData\Roaming\lib\sqlite-jdbc-3.14.2.1.jar

          Filesize

          4.1MB

          MD5

          b33387e15ab150a7bf560abdc73c3bec

          SHA1

          66b8075784131f578ef893fd7674273f709b9a4c

          SHA256

          2eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491

          SHA512

          25cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279

        • C:\Users\Admin\AppData\Roaming\lib\system-hook-3.5.jar

          Filesize

          772KB

          MD5

          e1aa38a1e78a76a6de73efae136cdb3a

          SHA1

          c463da71871f780b2e2e5dba115d43953b537daf

          SHA256

          2ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609

          SHA512

          fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d

        • C:\Users\Admin\AppData\Roaming\wkewogjrdf.txt

          Filesize

          209KB

          MD5

          c4d205a56ff6971ca58460cd4fe9f7db

          SHA1

          20aaae5dc2f1cbc7f3bc281fd91b57d51a2c7d80

          SHA256

          e8533d9ed906d969b147d6b444234bac03d4bc6d120fe53b23747029b48b5fa5

          SHA512

          c493394b1f4b9dee1a3445da803975a5000758c98ba781104bbaf9790097af87cfe8ffacc86cef4dc2907a741dde3bc9f2e4ccf04dbb4a0963eb0fd73215b169

        • C:\Users\Admin\AppData\Roaming\wkewogjrdf.txt

          Filesize

          209KB

          MD5

          c4d205a56ff6971ca58460cd4fe9f7db

          SHA1

          20aaae5dc2f1cbc7f3bc281fd91b57d51a2c7d80

          SHA256

          e8533d9ed906d969b147d6b444234bac03d4bc6d120fe53b23747029b48b5fa5

          SHA512

          c493394b1f4b9dee1a3445da803975a5000758c98ba781104bbaf9790097af87cfe8ffacc86cef4dc2907a741dde3bc9f2e4ccf04dbb4a0963eb0fd73215b169

        • C:\Users\Admin\lib\jna-5.5.0.jar

          Filesize

          1.4MB

          MD5

          acfb5b5fd9ee10bf69497792fd469f85

          SHA1

          0e0845217c4907822403912ad6828d8e0b256208

          SHA256

          b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e

          SHA512

          e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa

        • C:\Users\Admin\lib\jna-platform-5.5.0.jar

          Filesize

          2.6MB

          MD5

          2f4a99c2758e72ee2b59a73586a2322f

          SHA1

          af38e7c4d0fc73c23ecd785443705bfdee5b90bf

          SHA256

          24d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5

          SHA512

          b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494

        • C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jar

          Filesize

          4.1MB

          MD5

          b33387e15ab150a7bf560abdc73c3bec

          SHA1

          66b8075784131f578ef893fd7674273f709b9a4c

          SHA256

          2eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491

          SHA512

          25cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279

        • C:\Users\Admin\lib\system-hook-3.5.jar

          Filesize

          772KB

          MD5

          e1aa38a1e78a76a6de73efae136cdb3a

          SHA1

          c463da71871f780b2e2e5dba115d43953b537daf

          SHA256

          2ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609

          SHA512

          fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d

        • C:\Users\Admin\wkewogjrdf.txt

          Filesize

          209KB

          MD5

          c4d205a56ff6971ca58460cd4fe9f7db

          SHA1

          20aaae5dc2f1cbc7f3bc281fd91b57d51a2c7d80

          SHA256

          e8533d9ed906d969b147d6b444234bac03d4bc6d120fe53b23747029b48b5fa5

          SHA512

          c493394b1f4b9dee1a3445da803975a5000758c98ba781104bbaf9790097af87cfe8ffacc86cef4dc2907a741dde3bc9f2e4ccf04dbb4a0963eb0fd73215b169

        • memory/604-214-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-191-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-213-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-206-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-205-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-204-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-196-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-194-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-145-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-223-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-190-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-189-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-182-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-179-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-177-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-169-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/604-154-0x00000000008E0000-0x00000000008E1000-memory.dmp

          Filesize

          4KB

        • memory/1784-272-0x0000000000870000-0x0000000000871000-memory.dmp

          Filesize

          4KB

        • memory/2156-240-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

          Filesize

          4KB