Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
29-06-2022 07:57
Static task
static1
Behavioral task
behavioral1
Sample
receipt#.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
receipt#.js
Resource
win10v2004-20220414-en
General
-
Target
receipt#.js
-
Size
43KB
-
MD5
c2fccb1379ea9c93fa035c236c0d0627
-
SHA1
4fb24cde2f2879dfc0ca43ca2c2e42af8efcf7da
-
SHA256
27026383c0fbcc79e6eacfb629b41261afac694e69fa67749ab2d0d1a6493d2b
-
SHA512
dc0963d8a2fe131eccc800ea5a88cbd85aa6473c6080544cebde819e6cb8ad8e99387f604c2e2d9cb6bea086a01705e3230ce5cb09878dff0840cf3b766e0ee2
Malware Config
Extracted
vjw0rm
http://zeegod.duckdns.org:9004
http://paypalintelsassistant.duia.ro:8153
Signatures
-
Blocklisted process makes network request 21 IoCs
Processes:
wscript.exewscript.exeflow pid process 6 2004 wscript.exe 7 4200 wscript.exe 12 4200 wscript.exe 13 4200 wscript.exe 16 4200 wscript.exe 26 4200 wscript.exe 33 4200 wscript.exe 35 4200 wscript.exe 41 4200 wscript.exe 44 4200 wscript.exe 45 4200 wscript.exe 46 4200 wscript.exe 47 4200 wscript.exe 50 4200 wscript.exe 51 4200 wscript.exe 52 4200 wscript.exe 53 4200 wscript.exe 54 4200 wscript.exe 55 4200 wscript.exe 56 4200 wscript.exe 57 4200 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PLgBtFniEj.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PLgBtFniEj.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\receipt#.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\PLgBtFniEj.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KYXNMD0WI5 = "\"C:\\Users\\Admin\\receipt#.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.exedescription pid process target process PID 2004 wrote to memory of 4200 2004 wscript.exe wscript.exe PID 2004 wrote to memory of 4200 2004 wscript.exe wscript.exe PID 2004 wrote to memory of 1396 2004 wscript.exe schtasks.exe PID 2004 wrote to memory of 1396 2004 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\receipt#.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PLgBtFniEj.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\receipt#.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\PLgBtFniEj.jsFilesize
15KB
MD5f57b49d4468a8fbf4d775b1e7b86bac6
SHA15722a00fd5290541667c7c49fd11fa9efe739ebb
SHA25612c555961758332d34fe96bed18ca34aeffa81d64dfa651825ce505d36a92f73
SHA5124187de1abc4991d1ec8982c755b7d3dfdc032e884a1196d38d8be4f26c97ae51ff721867f7ac1ed72302c3833b1787d5685b9163b0a34b7917a4178d898e13ca
-
memory/1396-132-0x0000000000000000-mapping.dmp
-
memory/4200-130-0x0000000000000000-mapping.dmp