Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
04-12-2021 07:08
Static task
static1
Behavioral task
behavioral1
Sample
receipt#.js
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
receipt#.js
Resource
win10-en-20211104
General
-
Target
receipt#.js
-
Size
22KB
-
MD5
13fb0284023b235db4c118f0173c272c
-
SHA1
71bf685ab695101244f4c2aebc4f257911b7e302
-
SHA256
b2fb92728d4406136e6934be420befd0306ea69b03540e73e0d718a6d09e0f70
-
SHA512
e8d635e4695f0905331d263f71706a2ce404140de9037f1a9691616e30009c990e1512b1921c5e3e4041aa49743fa8fab10c8588910cc401fc7f12068af0daed
Malware Config
Extracted
vjw0rm
http://zeegod.duckdns.org:9998
Signatures
-
Blocklisted process makes network request 18 IoCs
Processes:
wscript.exewscript.exeflow pid process 8 664 wscript.exe 9 1752 wscript.exe 10 664 wscript.exe 13 664 wscript.exe 15 664 wscript.exe 18 664 wscript.exe 20 664 wscript.exe 23 664 wscript.exe 25 664 wscript.exe 26 664 wscript.exe 29 664 wscript.exe 32 664 wscript.exe 34 664 wscript.exe 36 664 wscript.exe 39 664 wscript.exe 40 664 wscript.exe 43 664 wscript.exe 46 664 wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hgMQjNbTZm.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hgMQjNbTZm.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\receipt#.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\YSAGQWKNY8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\receipt#.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\hgMQjNbTZm.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 1752 wrote to memory of 664 1752 wscript.exe wscript.exe PID 1752 wrote to memory of 664 1752 wscript.exe wscript.exe PID 1752 wrote to memory of 664 1752 wscript.exe wscript.exe PID 1752 wrote to memory of 1140 1752 wscript.exe schtasks.exe PID 1752 wrote to memory of 1140 1752 wscript.exe schtasks.exe PID 1752 wrote to memory of 1140 1752 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\receipt#.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\hgMQjNbTZm.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\receipt#.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\hgMQjNbTZm.jsMD5
d0f1a684002735cf158c3fe44e2c0e94
SHA156e3369154b815344c30589ada5cbd198beb98fa
SHA256c293fc6c91c5a4a889bb96411d58c7af35d623ab1392f8be4ae44874d15e0073
SHA512fc1a4b3f90ec1e4fe97799cf7f248a4221747b0a226907bb53c8821498a4d0e582252a1f180de3f65e5ee0ec1f831bdc56ae8db02c60e76e71bbb72bb5c9b676
-
memory/664-55-0x0000000000000000-mapping.dmp
-
memory/1140-57-0x0000000000000000-mapping.dmp