Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
29/06/2023, 22:45
Static task
static1
Behavioral task
behavioral1
Sample
Jsreceipt0193617_PDF.html
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Jsreceipt0193617_PDF.html
Resource
win10-20230621-en
General
-
Target
Jsreceipt0193617_PDF.html
-
Size
103B
-
MD5
c349aed7796c6cf3784b423f7a348429
-
SHA1
1f9f048f524a83ad569e0df65b709bc1de4f344f
-
SHA256
07176693f0658bb82e3408ef1e85a545b039acf315749ce888dfce55252696cc
-
SHA512
f505e8dfd29079f11b817204334e65a6c307e6bed8d5a04a7a95fef32bf4031040ef7830b7f039f596c904a489de2887d0903016204e1e78b9715126ccb1e455
Malware Config
Extracted
vjw0rm
http://jsnew9400.duckdns.org:9400
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 32 1868 WScript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jsreceipt0193617_pdf.js WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Run\MS8ABDCUZM = "\"C:\\Users\\Admin\\AppData\\Roaming\\Jsreceipt0193617_pdf.js\"" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 40ea0b90dbaad901 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ba9881dbaad901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "394843708" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f9684199b2f7a4a86f864ecc4ec016b00000000020000000000106600000001000020000000140e023097a876ec24a41621a0a1d391fc9332386b4922ddd20b65114ea17469000000000e800000000200002000000002c0eb2e934a1c4f307eb6b3ae4bc5d519a39ca3ef8ba640236ca95fe3cb843f20000000c10cd359ee90818f4e864289ead47d9f7d9b895581ab23a15af2ed05941641a8400000002259fca02f35f2b2b6c1425f5b7e290766ffba39594c9ae05cbd238e8757caeb9ed0bf4651a736f789aff53509336458f5f11ed2c718dd3d74550ec818a0fb17 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f9684199b2f7a4a86f864ecc4ec016b000000000200000000001066000000010000200000001a5be31299d923c2e4f6c45d8aa251d744697d7628c0bddc22d25086bf2799f0000000000e80000000020000200000001a39b943c4b7d592bfeb5a6cb1a7d0ccb5d8b5f779d5faa9046cb66f336d976290000000129a9efb269d8f932b92572133b89f147cc23ed754db0faaf632e274070fb7d01384ec86b11585ee3be53c3114d09397b1df02398c2f5888e8bad56e5c01183b1d7da7d41a053caa2e8412e99925e941559bd6bed9d2fe04dc0e8f43592e6f56ac3f4c10ad44dc8c9afddf8f6b1b1b0e243d6f98fb36a8bf1fa4afa262e596caebdb04dee84ba92fbc76ff1fdd3e7b4640000000d1908a41edbad695b8c848be18090bc8719072a2bcf66c0352d1392a946841ea1c4104abc1742ec6205a7c0f2d52b21a1881d85af559cd215fb387b7a1191946 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7AEF841-16CE-11EE-B17D-D20061566496} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1572 iexplore.exe 1572 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1572 iexplore.exe 1572 iexplore.exe 860 IEXPLORE.EXE 860 IEXPLORE.EXE 860 IEXPLORE.EXE 860 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1572 wrote to memory of 860 1572 iexplore.exe 27 PID 1572 wrote to memory of 860 1572 iexplore.exe 27 PID 1572 wrote to memory of 860 1572 iexplore.exe 27 PID 1572 wrote to memory of 860 1572 iexplore.exe 27 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Jsreceipt0193617_PDF.html1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1572 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:860
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Jsreceipt0193617_pdf.zip\Jsreceipt0193617_pdf.js"1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1868
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e3edb5bb319879f7c5c4dafc9ba6c49
SHA15bf15decdb008d3833a9200a4f45593cae45fda2
SHA256692a1c366b52cee8afaceefcce776b2348d05751bd619f28d3f9fe6c96788c05
SHA5127752c8d1f705fe60bed143246781ba37c9d612481cbcabb8f3d26f02d3127e4e53f0e943b9b8da8089e2a76333b6ee6da6ab0199c2af815447cc74bfee7c89ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d60b73038d5c448ffb7080e45fda5622
SHA151f82fc187792380e1a4e6d816e78e5f4b545fe7
SHA2567d79d3e938a9191feff40424540d692936c0afaa9d33ad1bc1e278c8619279ef
SHA51203d7f77ed1f5611a7a16ca9ff3adbb551e607a561b717591ce103631185b2b6b157607e8a8a1aed8626f58d594c102465f54d409349bb898ea8de6ac0a2da28e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503d78ef4ee8cfa2914ea9d1015993ac2
SHA16e1de39ce0ab26288f497e4f08f4205b49c53ca5
SHA2563991f607ec90e4ad4cc85a894b22d1c86d8b9472d5443f8a059be3664085c0c6
SHA51242aaf5dbcc11930a8708ff57c3b62f95345515cfc817a4970e2b0c7fff4bd20f16d8be86ca50de0e804910855ca33501d0b28f6fe34bde1411913cb70adc2273
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5285a3df3009f9fc051b547479cbda791
SHA1deb43260c55206690f7d582fa279a7df1b85b525
SHA2568635d85330d82c65885c3744e1a5e3bc8a27e8a24ecc518a6d278becf18c5e5b
SHA512230263a93a757dd752b4d659acd0d24db3a1fc2124b9b72eefaa1571767b97bbaa0102fbb32927b798ce6c9275cebadbe2959c067d8c5170b59396365fab2a41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d96a9e0e3f902e7a673a56053c2cebc
SHA14b87bdae05b7732a7107bdf37d039a8b6aa94bba
SHA256e55ef10ed3486f1b97b6772467ad1e9fca73da94335e4f44ebeee0edf59b2f18
SHA512ca7b2a4fe9b9575531d872d33ef14fd4e5d6be6b765af2e15820ac3d7e6c0aa48bfa7a2f0007bbca47e8126f6c1e02f74e271a80dfa0b6b61958de3a5c834c20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df3f914e765885ed43d2ee8d2a776b9b
SHA1295473b75f195dd9df90246e9a6576947dfa3e3d
SHA256fce27852a2c61e8612c7672ed8e9acfcb1515b26af7136cccf0981b2a82b8add
SHA512f2a350fefac80267046b1cb8371540a1cc75e116f31fcc4bfb913d8a947f2387ff4ab7a2a5f314b198bb82c9742a0f14b05437f3a64195e1b0281cf976cd22b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5811ab4235d15ab17a176dfa3f3696484
SHA16ca32143398731096a04b57d9f2d07950a74b7ed
SHA256ffb6aa15786a0630f8c90f1efeb31b362028546891f948172c79c803a15ac81f
SHA512175a5f3d9ed84ced3a782144ede42085c534b6dd6679d3b5479fa3fc17470b0c060290ace75165e586a726a87a3d08ba6f49d85ee05d113c519631cedf8915e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddd5e95228afcb43c38f75745a1ca459
SHA1814fca76467871a6652f30c27e4c5c30279e61de
SHA2567f81a60f5237f0303a2b38d44809341f31a5424572bb35cc29772d6856d22dd4
SHA512e618ad1f71983b2accf19468ff823bdfbceffda3ea72245f6a24b31cf1c40826f74bf4e4bab9110b07d4dfa3add1e9dc75b59b8bc541d2e71a72242dee0035e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e1a8f51c23281aef254d62bf2461eea
SHA1e22b762a8d99f647d713de9e5afd24bb83b5ee8e
SHA25625a516478db1aa57af05beda9c3fee7fe69eef339863ba72a341ade45ad27271
SHA51202d3e50aae9efd891dd954166822f830b75a370c6a2f7579502b074de8271a5b38b62ce7d4ad2437114f0b78a25da3ef1ec7a866b78d588443eda4d4f2367112
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da4e4df3cbc5c7420fe4ef110ca38b4d
SHA1be1e6e7c263d735a2e40ad3634b79a5266d169ce
SHA2569136a9c9b1a9dabf58ba98c3aa2729402c82680f3bb23264114f03e0facedd67
SHA5124c2e4f89a7b7e3a1227e092b844442fd810650ef7266b27924e2518b4810539e3f88f8b372ae45b3c1d4666b07057e2933ddff8a16d8c8c3627309870da0d85b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HZMQ0AZF\Jsreceipt0193617_pdf[1].zip
Filesize300KB
MD5b3f848fe0250349da6b62939ac0b848e
SHA19b15a7ca6b7832c48f028de394bfd0c796bc560a
SHA256a174433a80690c315a52012c68ca86c3b03683ff6fd8420a261146d747ba93fb
SHA512c5e46ca54d198a6287769078130b266d21c72efb7a1ca8c9d69ed1be8613619c6e5cc1436665151b1ad86a5533bbd7546060728de4393b783066302cc41717cd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HZMQ0AZF\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T7SBST7U\Jsreceipt0193617_pdf.zip.ep1g0r6.partial
Filesize300KB
MD5b3f848fe0250349da6b62939ac0b848e
SHA19b15a7ca6b7832c48f028de394bfd0c796bc560a
SHA256a174433a80690c315a52012c68ca86c3b03683ff6fd8420a261146d747ba93fb
SHA512c5e46ca54d198a6287769078130b266d21c72efb7a1ca8c9d69ed1be8613619c6e5cc1436665151b1ad86a5533bbd7546060728de4393b783066302cc41717cd
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
603B
MD52ecde963e35699fdaef1f50d07fc7f2d
SHA13aef10223467514b275f3961964a64295ca251e3
SHA25685ab19a79070cd43728e483adb13423514fcd07484ef2eb458762cd4b8efd804
SHA512a03b2dc45883b4530bf18e58016854457e45f9531866ac91bd3aa0ef97ea3a733e867583e3203178a2898031f6194107a07ed204876f78399e00eb1cabb99e31