Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2022, 06:30

General

  • Target

    Payment_PDF.js

  • Size

    422KB

  • MD5

    76270dd3deea3e9dd66669d65d172e67

  • SHA1

    faf4a0e7eb49b7eb8c7a0bd24444de8d6ab663de

  • SHA256

    c3bd44142ca1e00f28b4a76267258f6086e776f02ca87f1f96002636e3f4ba8f

  • SHA512

    e2274a63050d9092ceff819c1cd5a0fdd1d7044ca5d693e85cff31b00db002b29b75d5a115ab9ea2c0926c80112d4fed21aa19e32d612bf7703ba324479cbf1c

Malware Config

Signatures

  • NetWire RAT payload 4 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Blocklisted process makes network request 15 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Payment_PDF.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\rQhOtXJthh.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      PID:1528
    • C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe
      "C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe
        "C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        PID:5000

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe

          Filesize

          227KB

          MD5

          fc6330d62ae89347dddf9e98d6dc2533

          SHA1

          b2a3104e8178e25b6b40cf8b19d60c1a4e03e969

          SHA256

          72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7

          SHA512

          1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

        • C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe

          Filesize

          227KB

          MD5

          fc6330d62ae89347dddf9e98d6dc2533

          SHA1

          b2a3104e8178e25b6b40cf8b19d60c1a4e03e969

          SHA256

          72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7

          SHA512

          1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

        • C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe

          Filesize

          227KB

          MD5

          fc6330d62ae89347dddf9e98d6dc2533

          SHA1

          b2a3104e8178e25b6b40cf8b19d60c1a4e03e969

          SHA256

          72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7

          SHA512

          1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

        • C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe

          Filesize

          227KB

          MD5

          fc6330d62ae89347dddf9e98d6dc2533

          SHA1

          b2a3104e8178e25b6b40cf8b19d60c1a4e03e969

          SHA256

          72c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7

          SHA512

          1cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c

        • C:\Users\Admin\AppData\Roaming\rQhOtXJthh.js

          Filesize

          6KB

          MD5

          6184bcc6205df8fddaeb86b9aa52deff

          SHA1

          ac7ac3935f5874332afd575d52258615b2af7f17

          SHA256

          baa17c7098f3e39a29fda9a0d4e1378e6c0501705e49b11f982c4b320bf1a37f

          SHA512

          c0b9e457d8e5acadbd3c6a0e2cd54d29edd4dd37aa9e03692c95728ca1fe0dbfad3161adf75d27895e94cd7828f19369bb5b04b16e25cf6dd4d15d2961c2cb03