Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 10:20
Static task
static1
Behavioral task
behavioral1
Sample
513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf.js
Resource
win7v20201028
Behavioral task
behavioral2
Sample
513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf.js
Resource
win10v20201028
General
-
Target
513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf.js
-
Size
3.2MB
-
MD5
071839cb9cb3d4e8abe9a7dcf3372ab3
-
SHA1
1994584a026fd610d160c3e47575d4a2eef50d2a
-
SHA256
513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf
-
SHA512
705485ca9ca9188a19cb37ed103e34107bf0edf7a1c76dd31ae75ea997fa95f0f3b397ccd1d652e311b37493d6c8a35115f2201f226eea2d30e265cd0c52ab5a
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request 21 IoCs
Processes:
wscript.exeflow pid process 13 4652 wscript.exe 15 4652 wscript.exe 16 4652 wscript.exe 18 4652 wscript.exe 22 4652 wscript.exe 23 4652 wscript.exe 24 4652 wscript.exe 25 4652 wscript.exe 26 4652 wscript.exe 27 4652 wscript.exe 28 4652 wscript.exe 29 4652 wscript.exe 30 4652 wscript.exe 31 4652 wscript.exe 34 4652 wscript.exe 35 4652 wscript.exe 36 4652 wscript.exe 37 4652 wscript.exe 38 4652 wscript.exe 39 4652 wscript.exe 40 4652 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
01000001.exepid process 4240 01000001.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf.js wscript.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
wscript.exe01000001.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\igfxFHYi = "C:\\Users\\Admin\\AppData\\Roaming\\igfxFHYi\\igfxFHYi.exe" 01000001.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 33 api.ipify.org 14 ip-api.com 32 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 20 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 31 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 38 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 18 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 23 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 25 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 16 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 27 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 34 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 28 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 29 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 30 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 36 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 40 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 22 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 24 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 26 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 39 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 13 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 35 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 37 WSHRAT|22B2BC15|EWYCRADZ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 18/1/2021|JavaScript-v3.4|NL:Netherlands -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
01000001.exepid process 4240 01000001.exe 4240 01000001.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
01000001.exedescription pid process Token: SeDebugPrivilege 4240 01000001.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
01000001.exepid process 4240 01000001.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 4652 wrote to memory of 4240 4652 wscript.exe 01000001.exe PID 4652 wrote to memory of 4240 4652 wscript.exe 01000001.exe PID 4652 wrote to memory of 4240 4652 wscript.exe 01000001.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\513d393c4188ecea5e050a259a28f385d6e155772841cfd62698c1b3cf5aeadf.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\01000001.exe"C:\Users\Admin\AppData\Local\Temp\01000001.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\01000001.exeMD5
e86c33fd459476072f863ebe6fba2383
SHA1ccd7c1abc38e3f4da01d7a618578038133bd35e6
SHA25611f09f57a082875c33391b6a44fb87bf079de520e6e44b4f7130fc2589addaeb
SHA5122f0a5dc71aebca2b5dc3431d39b4b788658d9d52fbd1bc839aee51d976a08d44def3f9d6c72eded95d573a1338bd68b7645e6d4b49c41e3cf54019dc81f1909f
-
C:\Users\Admin\AppData\Local\Temp\01000001.exeMD5
e86c33fd459476072f863ebe6fba2383
SHA1ccd7c1abc38e3f4da01d7a618578038133bd35e6
SHA25611f09f57a082875c33391b6a44fb87bf079de520e6e44b4f7130fc2589addaeb
SHA5122f0a5dc71aebca2b5dc3431d39b4b788658d9d52fbd1bc839aee51d976a08d44def3f9d6c72eded95d573a1338bd68b7645e6d4b49c41e3cf54019dc81f1909f
-
memory/4240-10-0x0000000005C70000-0x0000000005C71000-memory.dmpFilesize
4KB
-
memory/4240-5-0x0000000000000000-mapping.dmp
-
memory/4240-8-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/4240-9-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/4240-11-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/4240-12-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/4240-13-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/4240-14-0x0000000005C00000-0x0000000005C01000-memory.dmpFilesize
4KB
-
memory/4240-15-0x0000000006AE0000-0x0000000006AE1000-memory.dmpFilesize
4KB
-
memory/4240-16-0x0000000001570000-0x0000000001571000-memory.dmpFilesize
4KB
-
memory/4240-17-0x00000000056B1000-0x00000000056B2000-memory.dmpFilesize
4KB
-
memory/4652-2-0x000001FD2C940000-0x000001FD2CA41000-memory.dmpFilesize
1.0MB