Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 00:26
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_88d5612f38441b9fbccb9e2e43bba16291eea23e7d90bc7755920a0252369eff.iso
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_88d5612f38441b9fbccb9e2e43bba16291eea23e7d90bc7755920a0252369eff.iso
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
TOO89_Payment_Invoice.js
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
TOO89_Payment_Invoice.js
Resource
win10v2004-20241007-en
General
-
Target
TOO89_Payment_Invoice.js
-
Size
12KB
-
MD5
3e7dd715a15046585cb8034a1fa847b3
-
SHA1
4cbe1b633a7859821c0b7082385407cb140a0ba5
-
SHA256
5518f5e20b27a4b10ebc7abce37c733ab532354b5db6aed7edf19c25caba2ff3
-
SHA512
42777bf0328fe9844aa93e8394f11aba8d02d6bbc77980da2c22bb5b9f9a646763ed4506976dfbf3d2476ca63fbc0845bb5be64c3a6c745daffdd7f7d85f960a
-
SSDEEP
384:Y7z4C7+owFhl3rwUY5mn33QPHOS2A9P2N:Y7zV+ow5qk3AOSx9q
Malware Config
Signatures
-
Vjw0rm family
-
Blocklisted process makes network request 6 IoCs
flow pid Process 5 1848 wscript.exe 8 1848 wscript.exe 9 1848 wscript.exe 11 1848 wscript.exe 12 1848 wscript.exe 13 1848 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TOO89_Payment_Invoice.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TOO89_Payment_Invoice.js wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\6ID7YY2BDP = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TOO89_Payment_Invoice.js\"" wscript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1108 schtasks.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1108 1848 wscript.exe 31 PID 1848 wrote to memory of 1108 1848 wscript.exe 31 PID 1848 wrote to memory of 1108 1848 wscript.exe 31 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\TOO89_Payment_Invoice.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\TOO89_Payment_Invoice.js2⤵
- Scheduled Task/Job: Scheduled Task
PID:1108
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1