e75c65acc78374f43ab387d8eb1064a550111c5a22bf75d16af7cfe117191796

Analysis

max time kernel
139s
max time network
149s
platform
windows7_x64
resource
win7v20201028
submitted
13-01-2021 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JDPSA802320.js
Size

657KB
MD5

e87e4ce6983d916ded30c89431b27a2e
SHA1

8e60077e3d47bf1ca61051c7b31a34a621b93ec3
SHA256

e75c65acc78374f43ab387d8eb1064a550111c5a22bf75d16af7cfe117191796
SHA512

810b682c61d6979283cd867379ecb478ade89efce4c8e57d883c46241edd3a97863ab24782e32f02b736b3c05a2bd9933b3796a90b02591f5cce141abf502295

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

Processes:

wscript.exe

flow pid process

7 1676 wscript.exe
9 1676 wscript.exe
12 1676 wscript.exe
13 1676 wscript.exe
15 1676 wscript.exe
16 1676 wscript.exe
17 1676 wscript.exe

flow	pid	process
7	1676	wscript.exe
9	1676	wscript.exe
12	1676	wscript.exe
13	1676	wscript.exe
15	1676	wscript.exe
16	1676	wscript.exe
17	1676	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JDPSA802320.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JDPSA802320.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JDPSA802320 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\JDPSA802320.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\JDPSA802320 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\JDPSA802320.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ip-api.com

flow	ioc
6	ip-api.com

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\JDPSA802320.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-2-0x000007FEF7080000-0x000007FEF72FA000-memory.dmp

Filesize
2.5MB

Download