Analysis
-
max time kernel
153s -
max time network
185s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
31-08-2021 02:43
Static task
static1
Behavioral task
behavioral1
Sample
MPaycopy.js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
MPaycopy.js
Resource
win10v20210408
General
-
Target
MPaycopy.js
-
Size
26KB
-
MD5
e50cc2184078acbb9886740526f92975
-
SHA1
64b74fe23a2eff712000b258f15e92e4dcb0ae28
-
SHA256
8e0718cf9229c3ec7a9bca40b38b5b0e61031e2fdee4511c8de665170c153598
-
SHA512
7fc55bc3271bf8dbf9adb52727d25953ffe170ab098dad8f83b75d2f7631651765b81224cfa5e47406d36e6c10591529a2eef2e25eac8e272dc9d0840988b915
Malware Config
Signatures
-
Blocklisted process makes network request 48 IoCs
Processes:
wscript.exewscript.exeflow pid process 9 1240 wscript.exe 10 1652 wscript.exe 11 1652 wscript.exe 13 1240 wscript.exe 14 1652 wscript.exe 15 1652 wscript.exe 17 1240 wscript.exe 19 1652 wscript.exe 20 1652 wscript.exe 23 1240 wscript.exe 24 1652 wscript.exe 25 1652 wscript.exe 26 1240 wscript.exe 28 1652 wscript.exe 29 1652 wscript.exe 31 1240 wscript.exe 33 1652 wscript.exe 34 1652 wscript.exe 36 1240 wscript.exe 38 1652 wscript.exe 40 1240 wscript.exe 41 1652 wscript.exe 42 1240 wscript.exe 44 1652 wscript.exe 46 1652 wscript.exe 48 1240 wscript.exe 49 1652 wscript.exe 50 1652 wscript.exe 53 1240 wscript.exe 54 1652 wscript.exe 55 1652 wscript.exe 57 1240 wscript.exe 59 1652 wscript.exe 60 1652 wscript.exe 61 1240 wscript.exe 63 1652 wscript.exe 64 1652 wscript.exe 67 1240 wscript.exe 68 1652 wscript.exe 69 1652 wscript.exe 71 1240 wscript.exe 73 1652 wscript.exe 75 1240 wscript.exe 76 1652 wscript.exe 77 1240 wscript.exe 79 1652 wscript.exe 80 1652 wscript.exe 83 1240 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QFBaDfPcbm.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QFBaDfPcbm.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\QFBaDfPcbm.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\R343ND8XDN = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MPaycopy.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1652 wrote to memory of 1240 1652 wscript.exe wscript.exe PID 1652 wrote to memory of 1240 1652 wscript.exe wscript.exe PID 1652 wrote to memory of 1240 1652 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\MPaycopy.js1⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\QFBaDfPcbm.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\QFBaDfPcbm.jsMD5
1bd5ec41b28ca7cec093e8dfadef1d5b
SHA186fc74ba456c6fad7aca84f8f88046ea5fe0d519
SHA256450211bd8dd2d26ed399750d602b70a3a35200bafd0398b6c6a63cf7c95e8d46
SHA5123de650150406c1d421f06976e8afae0c7f694d2f7c368dbc7471179f82401a64fee143807ac1f9316a0815ee5abf5d34a6f3a8f65173af53961fdf9217313778
-
memory/1240-60-0x0000000000000000-mapping.dmp