Malware spam: "bank account report" leads to Locky

This fake financial spam has a malicious attachment:

From     "Boyd Dennis"
Date     Mon, 18 Jul 2016 11:34:11 +0200
Subject     bank account report


How is it going?

Thank you very much for responding my email in a very short time. Attached is the
bank account report. Please look at it again and see if you have any disapproval.

--Yours faithfully,Boyd DennisHSBC HLDGSPhone: +1 (593) 085-57-81, Fax: +1 (593)
085-57-41

The sender name and details vary, although it all follows the same pattern. Attached is a ZIP file containing elements of the recipients email address and some random digits. Contained within is a .wsf script that downloads a file from one of the following locations (thank you to my source for analysis):

acnek.com/fyxxbcsz
ahatv.com.au/twh7xv
anchortron.com/hiqsij
aquatixbottle.com/ygyngc
bailamecuba.com/4uyh5bex
banthaoduoc.com/v5g9z0s
BenavidezHoy.com/8zrg48k
bigislandhawaiihilorealestate.com/16h9p
bizconsulting.ro/bm8s7
blackdildo.net/h9kyu
bridgeplacements.com/dhbuk
calcoastlogistics.com/pda6bms
candobetter.net/5nt3ayk
cbactive.com/jw7l6mlr
christian-view.com/rwe24t
cinerd.info/ebiyhv
cloudbws.com/m0tu07b
colleenthestylist.com/rdrfp
containermx.com/tb4u2v
davisdoherty.co.nz/g0vi70
deanstum.com/z9opr
dnp9.com/zpfqk2l
ecpi.ro/cqema
equalityindonesia.com/b229mg
eurasian.fc2web.com/18nws9
findmobileauto.com/gh8ft
fusofrance.fr/nengga
gruposoluciomatica.com.br/ryi81
gv.com.my/qbnuau
ilkhaberadana.com/rmegjezz
kouzoncorporation.com/jikkhl
leeplastic.com/w49a80y
matthewmccright.org/sl8wu
my-result.ru/0j1nlpj8
ormanstressrelief.com/uhgoz3b
otwayorchard.net/u96kt
provincialpw.com/r0vaqf
quest.agency/0ovl6v5z
rsxxx.com/3vp8s83
s2mgmt.com/do40lc
serviceautoiasi.com/4tbvsfcz
smp.com.mx/hcoyv
thegracefamilychurch.com/ltxm3t
tip.ub.ac.id/36k8m2xt
trans-free.ru/2hx1l
travelabroadsecret.com/rxurfhqk
travoxsb.com/qmi5u0n
vakantiehuisinauvergne.com/apyd17
wcouto.com.br/9d207v

I don't have a copy of the payload at present, but it does phone home to:

77.222.54.202 (SpaceWeb CJSC, Russia)
91.240.86.221 (JSC Server, Russia)
176.111.63.51 (United Networks Of Ukraine Ltd , Ukraine)
209.126.112.14 (MegaHosterNetwork, Ukraine)

The payload appears to be Locky ransomware.

Recommended blocklist:
77.222.54.202
91.240.86.221
176.111.63.51
209.126.112.14