Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en -
submitted
15/09/2021, 09:07
Static task
static1
Behavioral task
behavioral1
Sample
Overdue Payment.js
Resource
win7-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Overdue Payment.js
Resource
win10-en
0 signatures
0 seconds
General
-
Target
Overdue Payment.js
-
Size
204KB
-
MD5
5745363d82b1904ef54b914325d9b69f
-
SHA1
5559ccd311497703b8092a51f6cd9301238ad401
-
SHA256
7790518717f1e1c674361b4b26955a522541d6f56b73ad27bae7ec9f078c4ce3
-
SHA512
389bc5ac5e8c816610c9bb089694a66ed9840ef4383248f91e84136f98811477c936ac6b503768a2a6ce0047981b9a10b304bb4fd777ec9ce7c4207963d101ec
Score
10/10
Malware Config
Signatures
-
WSHRAT Payload 1 IoCs
resource yara_rule behavioral2/files/0x000400000001aafe-116.dat family_wshrat -
Blocklisted process makes network request 34 IoCs
flow pid Process 7 4688 wscript.exe 8 4688 wscript.exe 9 4744 wscript.exe 10 4744 wscript.exe 12 4744 wscript.exe 14 4744 wscript.exe 16 4744 wscript.exe 17 4744 wscript.exe 18 4744 wscript.exe 20 4744 wscript.exe 21 4744 wscript.exe 22 4744 wscript.exe 23 4744 wscript.exe 24 4744 wscript.exe 25 4744 wscript.exe 26 4744 wscript.exe 27 4744 wscript.exe 28 4744 wscript.exe 34 4744 wscript.exe 35 4744 wscript.exe 39 4744 wscript.exe 41 4744 wscript.exe 42 4744 wscript.exe 43 4744 wscript.exe 44 4744 wscript.exe 45 4744 wscript.exe 46 4744 wscript.exe 47 4744 wscript.exe 48 4744 wscript.exe 49 4744 wscript.exe 50 4744 wscript.exe 51 4744 wscript.exe 52 4744 wscript.exe 53 4744 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Overdue Payment.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Overdue Payment.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Overdue Payment = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Overdue Payment.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Overdue Payment = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Overdue Payment.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Overdue Payment = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Overdue Payment.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Overdue Payment = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Overdue Payment.js\"" wscript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 33 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 16 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 41 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 43 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 45 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 49 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 17 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 25 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 27 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 50 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 10 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 20 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 21 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 44 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 24 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 28 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 35 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 48 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 51 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 52 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 8 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 22 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 46 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 47 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 26 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 34 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 39 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 42 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 53 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 14 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 18 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 23 WSHRAT|CE86B187|GSNTPAWQ|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 15/9/2021|JavaScript-v3.4|NL:Netherlands -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4688 wrote to memory of 4744 4688 wscript.exe 69 PID 4688 wrote to memory of 4744 4688 wscript.exe 69
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Overdue Payment.js"1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Overdue Payment.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4744
-