Analysis

  • max time kernel
    1798s
  • max time network
    1793s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    04/10/2021, 13:22

General

  • Target

    DkAiW.vbs

  • Size

    180KB

  • MD5

    4d8f225d32a420d577abb43f11109a4d

  • SHA1

    f7d8c8bf04aee5d32ea7a935a79a5f87a2913216

  • SHA256

    0434bd170395b848da4c6acd9e0a93c32e578bf76357d6e32603f3237a53f4fc

  • SHA512

    831fe1f5519b48556c5311f269275a8f6ffa2134807d0cff19b3c728f922f069b883abebcb9a1af5bde8ba4927cdc57474d174876e67ec1b6c99ee227eb525c8

Malware Config

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

  • WSHRAT Payload 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DkAiW.vbs"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\DkAiW.vbs"
      2⤵
      • Blocklisted process makes network request
      • Adds Run key to start application
      PID:2004
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1948
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x458
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1672

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1740-53-0x000007FEFC461000-0x000007FEFC463000-memory.dmp

      Filesize

      8KB