99806dffcac81a0036f89ac02826ef83ab0c0affe42f9d3276c7a73416712e99

General

Target

SwiftCopies.js
Size

249KB
MD5

c64283d97b88c7596e77dbe2cf07aa96
SHA1

adc39012adf334ae763bed7d3986b7c5488e610f
SHA256

99806dffcac81a0036f89ac02826ef83ab0c0affe42f9d3276c7a73416712e99
SHA512

e6f31cea207546b9bc8e04a86e17e6a3b1d7185fda4a0e1186c113e523109f83d55a6979996a9123e6b55c65755a760571c21808c8326d3bad288ba926d8552a

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 43 IoCs

Processes:

WScript.exewscript.exe

flow	pid	process
7	3580	WScript.exe
9	944	wscript.exe
11	944	wscript.exe
16	944	wscript.exe
18	3580	WScript.exe
21	944	wscript.exe
22	3580	WScript.exe
23	944	wscript.exe
24	944	wscript.exe
25	3580	WScript.exe
26	944	wscript.exe
27	3580	WScript.exe
28	944	wscript.exe
29	3580	WScript.exe
30	944	wscript.exe
31	944	wscript.exe
32	3580	WScript.exe
33	944	wscript.exe
34	3580	WScript.exe
35	944	wscript.exe
36	3580	WScript.exe
37	944	wscript.exe
38	944	wscript.exe
39	3580	WScript.exe
40	944	wscript.exe
41	3580	WScript.exe
42	944	wscript.exe
43	3580	WScript.exe
44	944	wscript.exe
45	944	wscript.exe
46	3580	WScript.exe
47	944	wscript.exe
48	3580	WScript.exe
49	944	wscript.exe
50	3580	WScript.exe
51	944	wscript.exe
52	944	wscript.exe
53	3580	WScript.exe
54	944	wscript.exe
55	3580	WScript.exe
56	944	wscript.exe
57	3580	WScript.exe
58	944	wscript.exe

Drops startup file 4 IoCs

Processes:

WScript.exewscript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sing.js	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftCopies.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftCopies.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sing.js	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\SwiftCopies = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\SwiftCopies.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SwiftCopies = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\SwiftCopies.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
Modifies registry class 1 IoCs

Processes:

wscript.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings wscript.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description pid process target process

PID 944 wrote to memory of 3580 944 wscript.exe WScript.exe
PID 944 wrote to memory of 3580 944 wscript.exe WScript.exe

flow	ioc
8	ip-api.com

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	wscript.exe

description	pid	process	target process
PID 944 wrote to memory of 3580	944	wscript.exe	WScript.exe
PID 944 wrote to memory of 3580	944	wscript.exe	WScript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\SwiftCopies.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sing.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:3580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sing.js

MD5
32b1accd6a263f1b850e52bffac047a5

SHA1
f8be4389b327be9e742e618eceae6919e0144b2e

SHA256
67be2d8895a4d7a72e14c45d127c4784be588eff872dc04cb055a6f3fb816a92

SHA512
bee63cf8981e71d9005f9068a37438e16b8b8c0caa3603b50d5f41f2c9b86cacff362b34c6b3bb57da91e6ef883098a6a36e411db2f6b33bdcf35c61cddf3fee

Download Submit
memory/3580-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads