Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2022 06:15
Static task
static1
Behavioral task
behavioral1
Sample
eReceipt.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eReceipt.js
Resource
win10v2004-20220812-en
General
-
Target
eReceipt.js
-
Size
20KB
-
MD5
e07134ac3929d76845a48a0eba4d80f3
-
SHA1
b386428d0df6b2e9c89f9ad2bc45f169e6e57e57
-
SHA256
1a49aaae2ba16cc05a96ebe87a81a5cd20de012e6970f3e252dbaf8ee99d3381
-
SHA512
981b1a54fdfeb67ea8d3023805f6810b66ee0a8a1741ee95816b07e0a4aad844318363aecab74e56478d3ced12002d0ed7b5115f1d333da32fa2489462bc7341
-
SSDEEP
384:QTjoy68n6K6HGIW6ghWKW6zYaJ7fhlnTao3jAq7+pQh/iNbGgTwO3kV:wnd6cpTVplZgbGgTwOUV
Malware Config
Extracted
vjw0rm
http://zeegod.duckdns.org:9004
Signatures
-
Blocklisted process makes network request 15 IoCs
Processes:
wscript.exewscript.exeflow pid process 6 4992 wscript.exe 7 3400 wscript.exe 19 3400 wscript.exe 30 3400 wscript.exe 32 3400 wscript.exe 38 3400 wscript.exe 41 3400 wscript.exe 42 3400 wscript.exe 43 3400 wscript.exe 45 3400 wscript.exe 46 3400 wscript.exe 47 3400 wscript.exe 48 3400 wscript.exe 49 3400 wscript.exe 50 3400 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 3 IoCs
Processes:
wscript.exewscript.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecOTkqWSWV.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecOTkqWSWV.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KYXNMD0WI5 = "\"C:\\Users\\Admin\\eReceipt.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
wscript.exedescription pid process target process PID 4992 wrote to memory of 3400 4992 wscript.exe wscript.exe PID 4992 wrote to memory of 3400 4992 wscript.exe wscript.exe PID 4992 wrote to memory of 4352 4992 wscript.exe schtasks.exe PID 4992 wrote to memory of 4352 4992 wscript.exe schtasks.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\eReceipt.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ecOTkqWSWV.js"2⤵
- Blocklisted process makes network request
- Drops startup file
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\eReceipt.js2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ecOTkqWSWV.jsFilesize
6KB
MD5c5bfe416f6a801a7424fc79dd8f6ef8d
SHA1672d15536f43d5565f70d8055b39af59996925d2
SHA256ba760a5cce3ab662b39760d301d75bd82b2e49328fe917a4135069ffa91dd428
SHA51285fc096d04dbc442a7871794c0161073cfd95cc69135109d393a774612225a3d372efe577187ccd9f268d07c56d7476c0d234b1651b2932da92680d6aa0d3be4
-
memory/3400-132-0x0000000000000000-mapping.dmp
-
memory/4352-134-0x0000000000000000-mapping.dmp