Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2022, 06:30
Static task
static1
Behavioral task
behavioral1
Sample
Payment_PDF.js
Resource
win7-20220812-en
General
-
Target
Payment_PDF.js
-
Size
422KB
-
MD5
76270dd3deea3e9dd66669d65d172e67
-
SHA1
faf4a0e7eb49b7eb8c7a0bd24444de8d6ab663de
-
SHA256
c3bd44142ca1e00f28b4a76267258f6086e776f02ca87f1f96002636e3f4ba8f
-
SHA512
e2274a63050d9092ceff819c1cd5a0fdd1d7044ca5d693e85cff31b00db002b29b75d5a115ab9ea2c0926c80112d4fed21aa19e32d612bf7703ba324479cbf1c
Malware Config
Signatures
-
NetWire RAT payload 4 IoCs
resource yara_rule behavioral2/files/0x000400000001e7b4-135.dat netwire behavioral2/files/0x000400000001e7b4-136.dat netwire behavioral2/files/0x000300000001e7cf-138.dat netwire behavioral2/files/0x000300000001e7cf-139.dat netwire -
Blocklisted process makes network request 15 IoCs
flow pid Process 2 1528 wscript.exe 10 1528 wscript.exe 13 1528 wscript.exe 22 1528 wscript.exe 24 1528 wscript.exe 28 1528 wscript.exe 33 1528 wscript.exe 35 1528 wscript.exe 36 1528 wscript.exe 38 1528 wscript.exe 39 1528 wscript.exe 40 1528 wscript.exe 41 1528 wscript.exe 42 1528 wscript.exe 43 1528 wscript.exe -
Executes dropped EXE 2 IoCs
pid Process 3780 Host Ip Js StartUp.exe 5000 Notepad.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation Host Ip Js StartUp.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rQhOtXJthh.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rQhOtXJthh.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Note.lnk Notepad.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\£2ëUíaÊ—KåL¦K®¨æ = "C:\\Users\\Admin\\AppData\\Roaming\\Googlee\\Notepad.exe" Notepad.exe Key created \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Notepad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1528 2528 wscript.exe 81 PID 2528 wrote to memory of 1528 2528 wscript.exe 81 PID 2528 wrote to memory of 3780 2528 wscript.exe 82 PID 2528 wrote to memory of 3780 2528 wscript.exe 82 PID 2528 wrote to memory of 3780 2528 wscript.exe 82 PID 3780 wrote to memory of 5000 3780 Host Ip Js StartUp.exe 84 PID 3780 wrote to memory of 5000 3780 Host Ip Js StartUp.exe 84 PID 3780 wrote to memory of 5000 3780 Host Ip Js StartUp.exe 84
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Payment_PDF.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\rQhOtXJthh.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:1528
-
-
C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe"C:\Users\Admin\AppData\Roaming\Host Ip Js StartUp.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe"C:\Users\Admin\AppData\Roaming\Googlee\Notepad.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
PID:5000
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
Filesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
Filesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
Filesize
227KB
MD5fc6330d62ae89347dddf9e98d6dc2533
SHA1b2a3104e8178e25b6b40cf8b19d60c1a4e03e969
SHA25672c15ab989fb449e62d6a560bdad1c9c39d61c21345322b8c1331235adf484a7
SHA5121cf0e356a72a525b585533adab9c2abe1cfef9127ef96fedefe840bf33248bb85752fd92ca447cc6ac2b0654b497c07e3e3d0f0e064958f0f17b3e79424d6a4c
-
Filesize
6KB
MD56184bcc6205df8fddaeb86b9aa52deff
SHA1ac7ac3935f5874332afd575d52258615b2af7f17
SHA256baa17c7098f3e39a29fda9a0d4e1378e6c0501705e49b11f982c4b320bf1a37f
SHA512c0b9e457d8e5acadbd3c6a0e2cd54d29edd4dd37aa9e03692c95728ca1fe0dbfad3161adf75d27895e94cd7828f19369bb5b04b16e25cf6dd4d15d2961c2cb03