Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-09-2022 06:15
Static task
static1
Behavioral task
behavioral1
Sample
eReceipt.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eReceipt.js
Resource
win10v2004-20220812-en
General
-
Target
eReceipt.js
-
Size
20KB
-
MD5
e07134ac3929d76845a48a0eba4d80f3
-
SHA1
b386428d0df6b2e9c89f9ad2bc45f169e6e57e57
-
SHA256
1a49aaae2ba16cc05a96ebe87a81a5cd20de012e6970f3e252dbaf8ee99d3381
-
SHA512
981b1a54fdfeb67ea8d3023805f6810b66ee0a8a1741ee95816b07e0a4aad844318363aecab74e56478d3ced12002d0ed7b5115f1d333da32fa2489462bc7341
-
SSDEEP
384:QTjoy68n6K6HGIW6ghWKW6zYaJ7fhlnTao3jAq7+pQh/iNbGgTwO3kV:wnd6cpTVplZgbGgTwOUV
Malware Config
Extracted
vjw0rm
http://zeegod.duckdns.org:9004
Signatures
-
Blocklisted process makes network request 17 IoCs
Processes:
wscript.exewscript.exeflow pid process 7 2000 wscript.exe 8 2012 wscript.exe 9 2000 wscript.exe 10 2000 wscript.exe 13 2000 wscript.exe 14 2000 wscript.exe 17 2000 wscript.exe 19 2000 wscript.exe 21 2000 wscript.exe 22 2000 wscript.exe 25 2000 wscript.exe 26 2000 wscript.exe 28 2000 wscript.exe 30 2000 wscript.exe 33 2000 wscript.exe 34 2000 wscript.exe 36 2000 wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecOTkqWSWV.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecOTkqWSWV.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\KYXNMD0WI5 = "\"C:\\Users\\Admin\\eReceipt.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
wscript.exedescription pid process target process PID 2012 wrote to memory of 2000 2012 wscript.exe wscript.exe PID 2012 wrote to memory of 2000 2012 wscript.exe wscript.exe PID 2012 wrote to memory of 2000 2012 wscript.exe wscript.exe PID 2012 wrote to memory of 1772 2012 wscript.exe schtasks.exe PID 2012 wrote to memory of 1772 2012 wscript.exe schtasks.exe PID 2012 wrote to memory of 1772 2012 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\eReceipt.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ecOTkqWSWV.js"2⤵
- Blocklisted process makes network request
- Drops startup file
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\eReceipt.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ecOTkqWSWV.jsFilesize
6KB
MD5c5bfe416f6a801a7424fc79dd8f6ef8d
SHA1672d15536f43d5565f70d8055b39af59996925d2
SHA256ba760a5cce3ab662b39760d301d75bd82b2e49328fe917a4135069ffa91dd428
SHA51285fc096d04dbc442a7871794c0161073cfd95cc69135109d393a774612225a3d372efe577187ccd9f268d07c56d7476c0d234b1651b2932da92680d6aa0d3be4
-
memory/1772-58-0x0000000000000000-mapping.dmp
-
memory/2000-55-0x0000000000000000-mapping.dmp
-
memory/2012-54-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmpFilesize
8KB