Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17/08/2022, 06:30
Static task
static1
Behavioral task
behavioral1
Sample
Payment_PDF.js
Resource
win7-20220812-en
General
-
Target
Payment_PDF.js
-
Size
422KB
-
MD5
76270dd3deea3e9dd66669d65d172e67
-
SHA1
faf4a0e7eb49b7eb8c7a0bd24444de8d6ab663de
-
SHA256
c3bd44142ca1e00f28b4a76267258f6086e776f02ca87f1f96002636e3f4ba8f
-
SHA512
e2274a63050d9092ceff819c1cd5a0fdd1d7044ca5d693e85cff31b00db002b29b75d5a115ab9ea2c0926c80112d4fed21aa19e32d612bf7703ba324479cbf1c
Malware Config
Signatures
-
NetWire RAT payload 7 IoCs
resource yara_rule behavioral1/files/0x000a0000000122b9-58.dat netwire behavioral1/files/0x000a0000000122b9-61.dat netwire behavioral1/files/0x00080000000122c2-62.dat netwire behavioral1/files/0x00080000000122c2-63.dat netwire behavioral1/files/0x00080000000122c2-65.dat netwire behavioral1/files/0x00080000000122c2-67.dat netwire behavioral1/files/0x00080000000122c2-68.dat netwire -
Blocklisted process makes network request 15 IoCs
flow pid Process 5 1104 wscript.exe 6 1104 wscript.exe 7 1104 wscript.exe 10 1104 wscript.exe 11 1104 wscript.exe 12 1104 wscript.exe 14 1104 wscript.exe 15 1104 wscript.exe 16 1104 wscript.exe 18 1104 wscript.exe 19 1104 wscript.exe 20 1104 wscript.exe 22 1104 wscript.exe 23 1104 wscript.exe 24 1104 wscript.exe -
Executes dropped EXE 2 IoCs
pid Process 2040 Host Ip Js StartUp.exe 720 Notepad.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rQhOtXJthh.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rQhOtXJthh.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Note.lnk Notepad.exe -
Loads dropped DLL 3 IoCs
pid Process 2040 Host Ip Js StartUp.exe 2040 Host Ip Js StartUp.exe 720 Notepad.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\£2ëUíaÊ—KåL¦K®¨æ = "C:\\Users\\Admin\\AppData\\Roaming\\Googlee\\Notepad.exe" Notepad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 112 wrote to memory of 1104 112 wscript.exe 27 PID 112 wrote to memory of 1104 112 wscript.exe 27 PID 112 wrote to memory of 1104 112 wscript.exe 27 PID 112 wrote to memory of 2040 112 wscript.exe 28 PID 112 wrote to memory of 2040 112 wscript.exe 28 PID 112 wrote to memory of 2040 112 wscript.exe 28 PID 112 wrote to memory of 2040 112 wscript.exe 28 PID 2040 wrote to memory of 720 2040 Host Ip Js StartUp.exe 30 PID 2040 wrote to memory of 720 2040 Host Ip Js StartUp.exe 30 PID 2040 wrote to memory of 720 2040 Host Ip Js StartUp.exe 30 PID 2040 wrote to memory of 720 2040 Host Ip Js StartUp.exe 30
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Payment_PDF.js1⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\rQhOtXJthh.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:1104
-
-
C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe"C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe"C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
PID:720
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
Filesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
Filesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
Filesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
Filesize
6KB
MD56184bcc6205df8fddaeb86b9aa52deff
SHA1ac7ac3935f5874332afd575d52258615b2af7f17
SHA256baa17c7098f3e39a29fda9a0d4e1378e6c0501705e49b11f982c4b320bf1a37f
SHA512c0b9e457d8e5acadbd3c6a0e2cd54d29edd4dd37aa9e03692c95728ca1fe0dbfad3161adf75d27895e94cd7828f19369bb5b04b16e25cf6dd4d15d2961c2cb03
-
Filesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
Filesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
Filesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c