6a00522a3bc04a45725e18ec41c81738d905fdf8b3c4859e86ee6a2a6d154b8f

General

Target

PO KVRQ-7436859-012.js
Size

179KB
MD5

869614f2b681a26d7f1ee690637ee9d2
SHA1

b31f9b66665e45e382d6f700153c735c67bdd82c
SHA256

6a00522a3bc04a45725e18ec41c81738d905fdf8b3c4859e86ee6a2a6d154b8f
SHA512

b6bc5022ff955226fbaa0cab40e6a012c2752febad87ce71a952ee5aad2900f334c3b10fa458055202a92589dfadf1c54a99669c216e85afd0388e2eae3c15bd

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

Processes:

wscript.exe

flow pid process

6 1424 wscript.exe
8 1424 wscript.exe
11 1424 wscript.exe
12 1424 wscript.exe
14 1424 wscript.exe
15 1424 wscript.exe
16 1424 wscript.exe

flow	pid	process
6	1424	wscript.exe
8	1424	wscript.exe
11	1424	wscript.exe
12	1424	wscript.exe
14	1424	wscript.exe
15	1424	wscript.exe
16	1424	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO KVRQ-7436859-012.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO KVRQ-7436859-012.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO KVRQ-7436859-012 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO KVRQ-7436859-012.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO KVRQ-7436859-012 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO KVRQ-7436859-012.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO KVRQ-7436859-012 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO KVRQ-7436859-012.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO KVRQ-7436859-012 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO KVRQ-7436859-012.js\""	wscript.exe

JavaScript code in executable 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\PO KVRQ-7436859-012.js	js
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO KVRQ-7436859-012.js	js

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ip-api.com

flow	ioc
5	ip-api.com

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1904 wrote to memory of 1424	1904	wscript.exe	wscript.exe
PID 1904 wrote to memory of 1424	1904	wscript.exe	wscript.exe
PID 1904 wrote to memory of 1424	1904	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO KVRQ-7436859-012.js"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PO KVRQ-7436859-012.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:1424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO KVRQ-7436859-012.js

MD5
869614f2b681a26d7f1ee690637ee9d2

SHA1
b31f9b66665e45e382d6f700153c735c67bdd82c

SHA256
6a00522a3bc04a45725e18ec41c81738d905fdf8b3c4859e86ee6a2a6d154b8f

SHA512
b6bc5022ff955226fbaa0cab40e6a012c2752febad87ce71a952ee5aad2900f334c3b10fa458055202a92589dfadf1c54a99669c216e85afd0388e2eae3c15bd

Download Submit
C:\Users\Admin\AppData\Roaming\PO KVRQ-7436859-012.js

MD5
869614f2b681a26d7f1ee690637ee9d2

SHA1
b31f9b66665e45e382d6f700153c735c67bdd82c

SHA256
6a00522a3bc04a45725e18ec41c81738d905fdf8b3c4859e86ee6a2a6d154b8f

SHA512
b6bc5022ff955226fbaa0cab40e6a012c2752febad87ce71a952ee5aad2900f334c3b10fa458055202a92589dfadf1c54a99669c216e85afd0388e2eae3c15bd

Download Submit
memory/576-6-0x000007FEF7730000-0x000007FEF79AA000-memory.dmp

Filesize
2.5MB

Download
memory/1424-2-0x0000000000000000-mapping.dmp

Download
memory/1904-4-0x0000000002600000-0x0000000002604000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads