Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
13-03-2022 16:37
Static task
static1
Behavioral task
behavioral1
Sample
receipt.js
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
receipt.js
Resource
win10v2004-20220310-en
General
-
Target
receipt.js
-
Size
66KB
-
MD5
6f3064d19d9af3374af22dd40df47850
-
SHA1
9a663a6b13430cc5018a23b348850ff76644f5fb
-
SHA256
779d2a6161c86c42ce9ed2888117b72a6778f050153654a0d9c0aa1e3ec3cfdc
-
SHA512
f8ba075afddbb3f3f7f64af145cbd9e70c02710689c70d47959f3e9ca38593bc29a6c28896ffb19621802a09981ebf31a96630d9cff115c91e25335f18e21f85
Malware Config
Extracted
vjw0rm
http://zeegod.duckdns.org:9001
Signatures
-
Blocklisted process makes network request 17 IoCs
Processes:
wscript.exewscript.exeflow pid process 23 4520 wscript.exe 24 4364 wscript.exe 29 4520 wscript.exe 30 4520 wscript.exe 39 4520 wscript.exe 40 4520 wscript.exe 41 4520 wscript.exe 44 4520 wscript.exe 46 4520 wscript.exe 47 4520 wscript.exe 48 4520 wscript.exe 49 4520 wscript.exe 50 4520 wscript.exe 53 4520 wscript.exe 54 4520 wscript.exe 55 4520 wscript.exe 56 4520 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GHCfqroCHm.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\receipt.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\receipt.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GHCfqroCHm.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LMOXHX511V = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\receipt.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\00FAYTSXGU = "\"C:\\Users\\Admin\\AppData\\Roaming\\GHCfqroCHm.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
wscript.exedescription pid process target process PID 4364 wrote to memory of 4520 4364 wscript.exe wscript.exe PID 4364 wrote to memory of 4520 4364 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\receipt.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\GHCfqroCHm.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\GHCfqroCHm.jsMD5
eaa8511b7082f30b4a6e46702014f014
SHA1dbc2dfad64e5f7b00492743f706fddeed984fd9b
SHA256545360cb2972730fa0cdcd01b56deab97cdbe4a113b626962ab20877c79586d2
SHA51217cf9357656987f5c9595c8157cad0b864a836a2cf910bdaf67f1468838fff42fedde1cfe419487d177f9ef472d88a72378300230d6b2deb2cb56a6bc9d7c9f2