Analysis
-
max time kernel
150s -
max time network
181s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29/09/2021, 04:13
Static task
static1
Behavioral task
behavioral1
Sample
Scano005110.js
Resource
win7v20210408
General
-
Target
Scano005110.js
-
Size
5.2MB
-
MD5
a3a411523aa5bf3818e8925e908be9a2
-
SHA1
e356ce5f29c820c5fc7ca65c242be082bafc8fe8
-
SHA256
052a6543d8392cf4c54e7f88f80b41f571ea4e937e3caa6fa9b42a860b40b30c
-
SHA512
edd2647484ef73879e4c48f8e89f6166bdc73725b17b8a95d3522fbac9954749b93ddc9043a4c0db2e58de382b5a97a7d96ec3ebe7cd36ee7fd7ae6d78f42e88
Malware Config
Extracted
Protocol: smtp- Host:
mail.legacypharma.com.pk - Port:
587 - Username:
[email protected] - Password:
aurangzeb1926
Signatures
-
NirSoft MailPassView 8 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/files/0x00040000000130cd-60.dat MailPassView behavioral1/files/0x00040000000130cd-61.dat MailPassView behavioral1/files/0x00030000000130d5-64.dat MailPassView behavioral1/files/0x00030000000130d5-66.dat MailPassView behavioral1/files/0x00030000000130d5-67.dat MailPassView behavioral1/memory/1836-72-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1836-73-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1836-75-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 8 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x00040000000130cd-60.dat WebBrowserPassView behavioral1/files/0x00040000000130cd-61.dat WebBrowserPassView behavioral1/files/0x00030000000130d5-64.dat WebBrowserPassView behavioral1/files/0x00030000000130d5-66.dat WebBrowserPassView behavioral1/files/0x00030000000130d5-67.dat WebBrowserPassView behavioral1/memory/396-77-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/396-76-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/396-79-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 11 IoCs
resource yara_rule behavioral1/files/0x00040000000130cd-60.dat Nirsoft behavioral1/files/0x00040000000130cd-61.dat Nirsoft behavioral1/files/0x00030000000130d5-64.dat Nirsoft behavioral1/files/0x00030000000130d5-66.dat Nirsoft behavioral1/files/0x00030000000130d5-67.dat Nirsoft behavioral1/memory/1836-72-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1836-73-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1836-75-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/396-77-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/396-76-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/396-79-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Blocklisted process makes network request 27 IoCs
flow pid Process 2 1052 wscript.exe 6 1052 wscript.exe 7 1052 wscript.exe 10 1052 wscript.exe 11 1052 wscript.exe 15 1052 wscript.exe 18 1052 wscript.exe 19 1052 wscript.exe 21 1052 wscript.exe 22 1052 wscript.exe 24 1052 wscript.exe 26 1052 wscript.exe 27 1052 wscript.exe 28 1052 wscript.exe 30 1052 wscript.exe 31 1052 wscript.exe 32 1052 wscript.exe 34 1052 wscript.exe 35 1052 wscript.exe 36 1052 wscript.exe 38 1052 wscript.exe 39 1052 wscript.exe 40 1052 wscript.exe 42 1052 wscript.exe 43 1052 wscript.exe 44 1052 wscript.exe 46 1052 wscript.exe -
Executes dropped EXE 2 IoCs
pid Process 828 fthost.exe 1308 Windows Update.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scano005110.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scano005110.js wscript.exe -
Loads dropped DLL 1 IoCs
pid Process 828 fthost.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Scano005110 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Scano005110.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Scano005110 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Scano005110.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" Windows Update.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com 13 whatismyipaddress.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1308 set thread context of 1836 1308 Windows Update.exe 33 PID 1308 set thread context of 396 1308 Windows Update.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 26 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 7 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 21 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 27 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 38 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 42 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 44 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 19 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 24 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 31 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 32 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 35 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 39 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 11 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 15 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 18 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 26 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 43 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 10 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 22 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 28 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 30 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 34 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 36 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 40 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 46 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2021|JavaScript-v3.4|NL:Netherlands -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 396 vbc.exe 1308 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1308 Windows Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1308 Windows Update.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1052 wrote to memory of 828 1052 wscript.exe 26 PID 1052 wrote to memory of 828 1052 wscript.exe 26 PID 1052 wrote to memory of 828 1052 wscript.exe 26 PID 1052 wrote to memory of 828 1052 wscript.exe 26 PID 828 wrote to memory of 1308 828 fthost.exe 31 PID 828 wrote to memory of 1308 828 fthost.exe 31 PID 828 wrote to memory of 1308 828 fthost.exe 31 PID 828 wrote to memory of 1308 828 fthost.exe 31 PID 828 wrote to memory of 1308 828 fthost.exe 31 PID 828 wrote to memory of 1308 828 fthost.exe 31 PID 828 wrote to memory of 1308 828 fthost.exe 31 PID 1308 wrote to memory of 1836 1308 Windows Update.exe 33 PID 1308 wrote to memory of 1836 1308 Windows Update.exe 33 PID 1308 wrote to memory of 1836 1308 Windows Update.exe 33 PID 1308 wrote to memory of 1836 1308 Windows Update.exe 33 PID 1308 wrote to memory of 1836 1308 Windows Update.exe 33 PID 1308 wrote to memory of 1836 1308 Windows Update.exe 33 PID 1308 wrote to memory of 1836 1308 Windows Update.exe 33 PID 1308 wrote to memory of 1836 1308 Windows Update.exe 33 PID 1308 wrote to memory of 1836 1308 Windows Update.exe 33 PID 1308 wrote to memory of 1836 1308 Windows Update.exe 33 PID 1308 wrote to memory of 396 1308 Windows Update.exe 34 PID 1308 wrote to memory of 396 1308 Windows Update.exe 34 PID 1308 wrote to memory of 396 1308 Windows Update.exe 34 PID 1308 wrote to memory of 396 1308 Windows Update.exe 34 PID 1308 wrote to memory of 396 1308 Windows Update.exe 34 PID 1308 wrote to memory of 396 1308 Windows Update.exe 34 PID 1308 wrote to memory of 396 1308 Windows Update.exe 34 PID 1308 wrote to memory of 396 1308 Windows Update.exe 34 PID 1308 wrote to memory of 396 1308 Windows Update.exe 34 PID 1308 wrote to memory of 396 1308 Windows Update.exe 34
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Scano005110.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\fthost.exe"C:\Users\Admin\AppData\Local\Temp\fthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"4⤵PID:1836
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:396
-
-
-