Analysis
-
max time kernel
155s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
08-02-2022 01:27
Static task
static1
Behavioral task
behavioral1
Sample
receipt.js
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
receipt.js
Resource
win10v2004-en-20220113
General
-
Target
receipt.js
-
Size
19KB
-
MD5
c12a75906e13948499a20fdbdd20a84f
-
SHA1
b972af62f4a356f022f2f7c1e82e474d7d0ab177
-
SHA256
66555e27267457b1ea719fb4ba3ca9412640b52019926ab2103ab331fab20bfb
-
SHA512
6b9b68f5b570a28b144c7580e8b896514e7b08fb164324ef5b7f9c33d43756b750312081f53c3dca9242add8205cef2d681ae08eeb845c12b0e585380cea6efa
Malware Config
Extracted
vjw0rm
http://warrr.duckdns.org:9997
Signatures
-
Blocklisted process makes network request 16 IoCs
Processes:
wscript.exewscript.exeflow pid process 8 844 wscript.exe 9 820 wscript.exe 10 844 wscript.exe 12 844 wscript.exe 14 844 wscript.exe 16 844 wscript.exe 17 844 wscript.exe 20 844 wscript.exe 21 844 wscript.exe 23 844 wscript.exe 25 844 wscript.exe 27 844 wscript.exe 28 844 wscript.exe 31 844 wscript.exe 32 844 wscript.exe 34 844 wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egwgcQTTsK.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\egwgcQTTsK.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\receipt.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\RV7KJCEOJC = "\"C:\\Users\\Admin\\AppData\\Roaming\\receipt.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\egwgcQTTsK.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 820 wrote to memory of 844 820 wscript.exe wscript.exe PID 820 wrote to memory of 844 820 wscript.exe wscript.exe PID 820 wrote to memory of 844 820 wscript.exe wscript.exe PID 820 wrote to memory of 1156 820 wscript.exe schtasks.exe PID 820 wrote to memory of 1156 820 wscript.exe schtasks.exe PID 820 wrote to memory of 1156 820 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\receipt.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\egwgcQTTsK.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\receipt.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\egwgcQTTsK.jsMD5
495e6539ceaf9dd7dedc8782c17b995e
SHA141dd327e945fc21d7e4803e213295511c612bdd8
SHA256e4c006bd48649e4ff67e782db5724881aaec82ecb1cd2929d9454a04ba17a406
SHA51244cae0658351eee91163a8bdd431c72266d528606b0517b606a85623c6eba78b4299a844bcc4bec41d41091c456792a6e39c16a694dae41219532e20999f2378
-
memory/820-55-0x000007FEFB731000-0x000007FEFB733000-memory.dmpFilesize
8KB