Analysis
- max time kernel
147s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
31/07/2023, 07:31
General
- Target POP 4888999525.js
- Size 335KB
- Sample230731-jcc9dsec6x
- SHA256 99feb902857229fff2ca72162768e7bdf6d6677de01dff2bb3c96b4876f5d240
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in Program Files directory 12 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\POP 4888999525.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\jllmbxg.txt"2⤵
- Drops file in Program Files directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
jllmbxg.txt
memory/4984-137-0x00000000026C0000-0x00000000036C0000-memory.dmp
memory/4984-146-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/4984-148-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/4984-156-0x00000000026C0000-0x00000000036C0000-memory.dmp
memory/4984-157-0x00000000026C0000-0x00000000036C0000-memory.dmp
memory/4984-158-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/4984-165-0x00000000026C0000-0x00000000036C0000-memory.dmp
memory/4984-172-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/4984-173-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/4984-178-0x00000000026C0000-0x00000000036C0000-memory.dmp
memory/4984-181-0x0000000002960000-0x0000000002970000-memory.dmp
memory/4984-182-0x00000000029C0000-0x00000000029D0000-memory.dmp
memory/4984-183-0x0000000002990000-0x00000000029A0000-memory.dmp
memory/4984-184-0x00000000026C0000-0x00000000036C0000-memory.dmp
memory/4984-185-0x00000000029A0000-0x00000000029B0000-memory.dmp
memory/4984-186-0x00000000029B0000-0x00000000029C0000-memory.dmp
memory/4984-187-0x00000000026C0000-0x00000000036C0000-memory.dmp