6a00522a3bc04a45725e18ec41c81738d905fdf8b3c4859e86ee6a2a6d154b8f

General

Target

PO KVRQ-7436859-012.js
Size

179KB
MD5

869614f2b681a26d7f1ee690637ee9d2
SHA1

b31f9b66665e45e382d6f700153c735c67bdd82c
SHA256

6a00522a3bc04a45725e18ec41c81738d905fdf8b3c4859e86ee6a2a6d154b8f
SHA512

b6bc5022ff955226fbaa0cab40e6a012c2752febad87ce71a952ee5aad2900f334c3b10fa458055202a92589dfadf1c54a99669c216e85afd0388e2eae3c15bd

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

Processes:

wscript.exe

flow pid process

15 1476 wscript.exe
17 1476 wscript.exe
26 1476 wscript.exe
28 1476 wscript.exe
31 1476 wscript.exe
32 1476 wscript.exe
35 1476 wscript.exe

flow	pid	process
15	1476	wscript.exe
17	1476	wscript.exe
26	1476	wscript.exe
28	1476	wscript.exe
31	1476	wscript.exe
32	1476	wscript.exe
35	1476	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO KVRQ-7436859-012.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO KVRQ-7436859-012.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO KVRQ-7436859-012 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO KVRQ-7436859-012.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO KVRQ-7436859-012 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO KVRQ-7436859-012.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO KVRQ-7436859-012 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO KVRQ-7436859-012.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO KVRQ-7436859-012 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO KVRQ-7436859-012.js\""	wscript.exe

JavaScript code in executable 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\PO KVRQ-7436859-012.js	js
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO KVRQ-7436859-012.js	js

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com

flow	ioc
14	ip-api.com

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 4068 wrote to memory of 1476	4068	wscript.exe	wscript.exe
PID 4068 wrote to memory of 1476	4068	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO KVRQ-7436859-012.js"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PO KVRQ-7436859-012.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO KVRQ-7436859-012.js

MD5
869614f2b681a26d7f1ee690637ee9d2

SHA1
b31f9b66665e45e382d6f700153c735c67bdd82c

SHA256
6a00522a3bc04a45725e18ec41c81738d905fdf8b3c4859e86ee6a2a6d154b8f

SHA512
b6bc5022ff955226fbaa0cab40e6a012c2752febad87ce71a952ee5aad2900f334c3b10fa458055202a92589dfadf1c54a99669c216e85afd0388e2eae3c15bd

Download Submit
C:\Users\Admin\AppData\Roaming\PO KVRQ-7436859-012.js

MD5
869614f2b681a26d7f1ee690637ee9d2

SHA1
b31f9b66665e45e382d6f700153c735c67bdd82c

SHA256
6a00522a3bc04a45725e18ec41c81738d905fdf8b3c4859e86ee6a2a6d154b8f

SHA512
b6bc5022ff955226fbaa0cab40e6a012c2752febad87ce71a952ee5aad2900f334c3b10fa458055202a92589dfadf1c54a99669c216e85afd0388e2eae3c15bd

Download Submit
memory/1476-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads