3ac7b7be256ed723792c50d44eb38da6207993463f7e7a5b1c3788ada0567d2e

General

Target

PaymentDetails#765.js
Size

240KB
MD5

74bccd5892c45290559b623d0f9f628f
SHA1

4b2d9066f1542453af9f37bc421684e7a6eec255
SHA256

3ac7b7be256ed723792c50d44eb38da6207993463f7e7a5b1c3788ada0567d2e
SHA512

2ab01e3d379194e4d7f86ce2d973e827ccbe0f680d023ba2bbbe4b70cb06268ca5a9a50166616ca99822d84e9fb244976f758e00e56f48c45d1931f8267384c2

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 25 IoCs

Processes:

wscript.exe

flow	pid	process
8	3992	wscript.exe
9	3992	wscript.exe
14	3992	wscript.exe
18	3992	wscript.exe
19	3992	wscript.exe
21	3992	wscript.exe
22	3992	wscript.exe
23	3992	wscript.exe
24	3992	wscript.exe
25	3992	wscript.exe
26	3992	wscript.exe
27	3992	wscript.exe
28	3992	wscript.exe
29	3992	wscript.exe
30	3992	wscript.exe
32	3992	wscript.exe
33	3992	wscript.exe
34	3992	wscript.exe
35	3992	wscript.exe
36	3992	wscript.exe
37	3992	wscript.exe
38	3992	wscript.exe
39	3992	wscript.exe
40	3992	wscript.exe
41	3992	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PaymentDetails#765.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PaymentDetails#765.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PaymentDetails#765 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PaymentDetails#765.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\PaymentDetails#765 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PaymentDetails#765.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PaymentDetails#765 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PaymentDetails#765.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\PaymentDetails#765 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PaymentDetails#765.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip-api.com
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description pid process target process

PID 816 wrote to memory of 3992 816 wscript.exe wscript.exe
PID 816 wrote to memory of 3992 816 wscript.exe wscript.exe

flow	ioc
7	ip-api.com

description	pid	process	target process
PID 816 wrote to memory of 3992	816	wscript.exe	wscript.exe
PID 816 wrote to memory of 3992	816	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PaymentDetails#765.js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PaymentDetails#765.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:3992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PaymentDetails#765.js
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\PaymentDetails#765.js
MD5
74bccd5892c45290559b623d0f9f628f

SHA1
4b2d9066f1542453af9f37bc421684e7a6eec255

SHA256
3ac7b7be256ed723792c50d44eb38da6207993463f7e7a5b1c3788ada0567d2e

SHA512
2ab01e3d379194e4d7f86ce2d973e827ccbe0f680d023ba2bbbe4b70cb06268ca5a9a50166616ca99822d84e9fb244976f758e00e56f48c45d1931f8267384c2

Download Submit
memory/3992-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads