Analysis
-
max time kernel
146s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27/09/2021, 09:32
Static task
static1
Behavioral task
behavioral1
Sample
Order_inquiry_024_027_21.js
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Order_inquiry_024_027_21.js
Resource
win10v20210408
General
-
Target
Order_inquiry_024_027_21.js
-
Size
77KB
-
MD5
de45b5317da50815bbe74c468de27c67
-
SHA1
60ac5ce964f24b4742d5b52de9f54ee50aef9aef
-
SHA256
122bb776bd98f8e068ed81cfe0f514f80106ba28296b06cc20ed51e665c9d8a1
-
SHA512
55b9ae05520e56d1ad4eefb5d1708fe83d93ea1b43c93a651b11a07ed8ae8ff20d7c12c9a4ce35fae715b1a22c10c477c2bbc639d74cd28b00ceb639ade3826a
Malware Config
Signatures
-
suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
-
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
-
Blocklisted process makes network request 28 IoCs
flow pid Process 2 392 wscript.exe 3 392 wscript.exe 4 392 wscript.exe 5 392 wscript.exe 8 392 wscript.exe 12 392 wscript.exe 19 392 wscript.exe 20 392 wscript.exe 21 392 wscript.exe 22 392 wscript.exe 23 392 wscript.exe 24 392 wscript.exe 27 392 wscript.exe 28 392 wscript.exe 29 392 wscript.exe 30 392 wscript.exe 31 392 wscript.exe 33 392 wscript.exe 34 392 wscript.exe 35 392 wscript.exe 36 392 wscript.exe 37 392 wscript.exe 38 392 wscript.exe 39 392 wscript.exe 40 392 wscript.exe 41 392 wscript.exe 42 392 wscript.exe 43 392 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Order_inquiry_024_027_21.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Order_inquiry_024_027_21.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Order_inquiry_024_027_21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Order_inquiry_024_027_21.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Order_inquiry_024_027_21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Order_inquiry_024_027_21.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Order_inquiry_024_027_21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Order_inquiry_024_027_21.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Order_inquiry_024_027_21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Order_inquiry_024_027_21.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 28 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 2 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 31 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 43 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 20 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 28 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 37 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 38 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 19 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 23 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 40 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 42 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 5 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 21 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 24 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 39 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 27 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 30 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 33 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 34 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 41 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 3 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 8 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 35 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 36 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 4 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 12 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 22 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript HTTP User-Agent header 29 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 27/9/2021|JavaScript -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 740 wrote to memory of 392 740 wscript.exe 68 PID 740 wrote to memory of 392 740 wscript.exe 68
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Order_inquiry_024_027_21.js1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Order_inquiry_024_027_21.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:392
-