3ac7b7be256ed723792c50d44eb38da6207993463f7e7a5b1c3788ada0567d2e

General

Target

PaymentDetails#765.js
Size

240KB
MD5

74bccd5892c45290559b623d0f9f628f
SHA1

4b2d9066f1542453af9f37bc421684e7a6eec255
SHA256

3ac7b7be256ed723792c50d44eb38da6207993463f7e7a5b1c3788ada0567d2e
SHA512

2ab01e3d379194e4d7f86ce2d973e827ccbe0f680d023ba2bbbe4b70cb06268ca5a9a50166616ca99822d84e9fb244976f758e00e56f48c45d1931f8267384c2

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 38 IoCs

Processes:

wscript.exe

flow	pid	process
7	2008	wscript.exe
8	2008	wscript.exe
9	2008	wscript.exe
10	2008	wscript.exe
11	2008	wscript.exe
12	2008	wscript.exe
13	2008	wscript.exe
15	2008	wscript.exe
16	2008	wscript.exe
17	2008	wscript.exe
18	2008	wscript.exe
19	2008	wscript.exe
20	2008	wscript.exe
22	2008	wscript.exe
23	2008	wscript.exe
24	2008	wscript.exe
25	2008	wscript.exe
26	2008	wscript.exe
27	2008	wscript.exe
29	2008	wscript.exe
30	2008	wscript.exe
31	2008	wscript.exe
32	2008	wscript.exe
33	2008	wscript.exe
34	2008	wscript.exe
36	2008	wscript.exe
37	2008	wscript.exe
38	2008	wscript.exe
39	2008	wscript.exe
40	2008	wscript.exe
41	2008	wscript.exe
43	2008	wscript.exe
44	2008	wscript.exe
45	2008	wscript.exe
46	2008	wscript.exe
47	2008	wscript.exe
48	2008	wscript.exe
50	2008	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PaymentDetails#765.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PaymentDetails#765.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\PaymentDetails#765 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PaymentDetails#765.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PaymentDetails#765 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PaymentDetails#765.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\PaymentDetails#765 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PaymentDetails#765.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PaymentDetails#765 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PaymentDetails#765.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ip-api.com

flow	ioc
6	ip-api.com

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1080 wrote to memory of 2008	1080	wscript.exe	wscript.exe
PID 1080 wrote to memory of 2008	1080	wscript.exe	wscript.exe
PID 1080 wrote to memory of 2008	1080	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PaymentDetails#765.js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PaymentDetails#765.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PaymentDetails#765.js

MD5
74bccd5892c45290559b623d0f9f628f

SHA1
4b2d9066f1542453af9f37bc421684e7a6eec255

SHA256
3ac7b7be256ed723792c50d44eb38da6207993463f7e7a5b1c3788ada0567d2e

SHA512
2ab01e3d379194e4d7f86ce2d973e827ccbe0f680d023ba2bbbe4b70cb06268ca5a9a50166616ca99822d84e9fb244976f758e00e56f48c45d1931f8267384c2

Download Submit
C:\Users\Admin\AppData\Roaming\PaymentDetails#765.js

MD5
74bccd5892c45290559b623d0f9f628f

SHA1
4b2d9066f1542453af9f37bc421684e7a6eec255

SHA256
3ac7b7be256ed723792c50d44eb38da6207993463f7e7a5b1c3788ada0567d2e

SHA512
2ab01e3d379194e4d7f86ce2d973e827ccbe0f680d023ba2bbbe4b70cb06268ca5a9a50166616ca99822d84e9fb244976f758e00e56f48c45d1931f8267384c2

Download Submit
memory/396-6-0x000007FEF8040000-0x000007FEF82BA000-memory.dmp

Filesize
2.5MB

Download
memory/1080-4-0x00000000024E0000-0x00000000024E4000-memory.dmp

Filesize
16KB

Download
memory/2008-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads