Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    16-03-2021 19:06

General

  • Target

    f94bfce5384f10201df977d67ea6c5d1.js

  • Size

    179KB

  • MD5

    f94bfce5384f10201df977d67ea6c5d1

  • SHA1

    fb5f56e7e554d466b6ca7264c2748826daac8cc7

  • SHA256

    ba25eeb1352d5aab2e09eaa942324510ecd964671e7def1e158c3a543534ca1b

  • SHA512

    492e18b7a219734a9564bd330f5350582bd3c01d72ce0eb491343777d32dec5162c6deaf2c97ee6d6f68e1e2a025182dc20312fc4fe7c1024e0970ab1056ef65

Malware Config

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

  • WSHRAT Payload 2 IoCs
  • Blocklisted process makes network request 37 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\f94bfce5384f10201df977d67ea6c5d1.js
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\f94bfce5384f10201df977d67ea6c5d1.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:1264

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f94bfce5384f10201df977d67ea6c5d1.js
    MD5

    361ef4bdd692cd343c1b7d55cfdb47da

    SHA1

    cec2a80071939ff12f5b7b72fe29b19e10d83b6a

    SHA256

    e136a9569671f20b1b02cc1ac69dc178e49e04cdead0c7cff3351ca1251ea752

    SHA512

    d7470011929b6548de6f2574383c0c0f952926c5a2c9486ef34fcd73a4a960db59119568e9fbe5419cd24a42e91f4c5849e47b3a8baf7af3575921bf23580869

  • C:\Users\Admin\AppData\Roaming\f94bfce5384f10201df977d67ea6c5d1.js
    MD5

    f94bfce5384f10201df977d67ea6c5d1

    SHA1

    fb5f56e7e554d466b6ca7264c2748826daac8cc7

    SHA256

    ba25eeb1352d5aab2e09eaa942324510ecd964671e7def1e158c3a543534ca1b

    SHA512

    492e18b7a219734a9564bd330f5350582bd3c01d72ce0eb491343777d32dec5162c6deaf2c97ee6d6f68e1e2a025182dc20312fc4fe7c1024e0970ab1056ef65

  • memory/1264-2-0x0000000000000000-mapping.dmp
  • memory/1708-6-0x000007FEF7F70000-0x000007FEF81EA000-memory.dmp
    Filesize

    2.5MB

  • memory/1880-5-0x00000000025E0000-0x00000000025E4000-memory.dmp
    Filesize

    16KB