Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-01-2021 09:43

General

  • Target

    0000060239911.js

  • Size

    3.2MB

  • MD5

    071839cb9cb3d4e8abe9a7dcf3372ab3

  • SHA1

    1994584a026fd610d160c3e47575d4a2eef50d2a

  • SHA256

    513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf

  • SHA512

    705485ca9ca9188a19cb37ed103e34107bf0edf7a1c76dd31ae75ea997fa95f0f3b397ccd1d652e311b37493d6c8a35115f2201f226eea2d30e265cd0c52ab5a

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

  • Blocklisted process makes network request 18 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops startup file 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 5 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Script User-Agent 17 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\0000060239911.js
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Users\Admin\AppData\Local\Temp\01000001.exe
      "C:\Users\Admin\AppData\Local\Temp\01000001.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3716

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\01000001.exe
    MD5

    e86c33fd459476072f863ebe6fba2383

    SHA1

    ccd7c1abc38e3f4da01d7a618578038133bd35e6

    SHA256

    11f09f57a082875c33391b6a44fb87bf079de520e6e44b4f7130fc2589addaeb

    SHA512

    2f0a5dc71aebca2b5dc3431d39b4b788658d9d52fbd1bc839aee51d976a08d44def3f9d6c72eded95d573a1338bd68b7645e6d4b49c41e3cf54019dc81f1909f

  • C:\Users\Admin\AppData\Local\Temp\01000001.exe
    MD5

    e86c33fd459476072f863ebe6fba2383

    SHA1

    ccd7c1abc38e3f4da01d7a618578038133bd35e6

    SHA256

    11f09f57a082875c33391b6a44fb87bf079de520e6e44b4f7130fc2589addaeb

    SHA512

    2f0a5dc71aebca2b5dc3431d39b4b788658d9d52fbd1bc839aee51d976a08d44def3f9d6c72eded95d573a1338bd68b7645e6d4b49c41e3cf54019dc81f1909f

  • memory/3716-8-0x0000000005850000-0x0000000005851000-memory.dmp
    Filesize

    4KB

  • memory/3716-5-0x0000000073560000-0x0000000073C4E000-memory.dmp
    Filesize

    6.9MB

  • memory/3716-6-0x0000000000F20000-0x0000000000F21000-memory.dmp
    Filesize

    4KB

  • memory/3716-7-0x0000000005C20000-0x0000000005C21000-memory.dmp
    Filesize

    4KB

  • memory/3716-2-0x0000000000000000-mapping.dmp
  • memory/3716-9-0x00000000057D0000-0x00000000057D1000-memory.dmp
    Filesize

    4KB

  • memory/3716-10-0x0000000005840000-0x0000000005841000-memory.dmp
    Filesize

    4KB

  • memory/3716-11-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
    Filesize

    4KB

  • memory/3716-12-0x0000000006C50000-0x0000000006C51000-memory.dmp
    Filesize

    4KB

  • memory/3716-13-0x00000000017A0000-0x00000000017A1000-memory.dmp
    Filesize

    4KB

  • memory/3716-14-0x0000000005841000-0x0000000005842000-memory.dmp
    Filesize

    4KB