Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
12-10-2021 08:35
Static task
static1
Behavioral task
behavioral1
Sample
eReceipt.js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
eReceipt.js
Resource
win10-en-20210920
General
-
Target
eReceipt.js
-
Size
25KB
-
MD5
75c51e4760f40c18863f675ef0d06501
-
SHA1
64a0bdded7dd1a220f77958f3bf322376cdb832f
-
SHA256
041857494d57688060972d7a46663f5295df45223e3445afa95d43e674fd053c
-
SHA512
7b2ba2b9fca230a2f5eb6ef4fa02b635bef472b6a506da914838645bdcb2e3ca5ff2734c0015ba9d1e65b615747b3ba3db0f6264184e6f0b980a5b216db83a42
Malware Config
Extracted
vjw0rm
http://loadcash.duckdns.org:7778
Signatures
-
Blocklisted process makes network request 13 IoCs
Processes:
wscript.exewscript.exeflow pid process 10 2668 wscript.exe 11 2116 wscript.exe 14 2668 wscript.exe 23 2668 wscript.exe 30 2668 wscript.exe 35 2668 wscript.exe 36 2668 wscript.exe 40 2668 wscript.exe 44 2668 wscript.exe 45 2668 wscript.exe 46 2668 wscript.exe 47 2668 wscript.exe 48 2668 wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zXdOQTClWR.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zXdOQTClWR.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\zXdOQTClWR.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\3W2CQPM6PM = "\"C:\\Users\\Admin\\AppData\\Roaming\\eReceipt.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
wscript.exedescription pid process target process PID 2116 wrote to memory of 2668 2116 wscript.exe wscript.exe PID 2116 wrote to memory of 2668 2116 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\eReceipt.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\zXdOQTClWR.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\zXdOQTClWR.jsMD5
1fd4ed003479cb6e23104c25a6d39f65
SHA179b8bdceafde6bd5c93443bfbb0eaf8b9389371c
SHA2563b3b7361c0c2bcdfc2897e9f6c9e33777fbd348780b4ad29ae3b1eef2c160778
SHA5127c5723b22e4064d281b7c06864a2d43a3331c1d2668cd6b3dc6d18a4e89902212108d4fadc158e60e1ef6983d57ab24923d0ed7b62e0589031208e5826cd803b
-
memory/2668-115-0x0000000000000000-mapping.dmp