Analysis
-
max time kernel
37s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
09/10/2021, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
uspstracker.js
Resource
win7-en-20210920
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
uspstracker.js
Resource
win10v20210408
0 signatures
0 seconds
General
-
Target
uspstracker.js
-
Size
1.1MB
-
MD5
3151f194fcfe3b210732d3f6bed59cbd
-
SHA1
84d181e892c2c51d29c70daa7f785aa4b9a256bd
-
SHA256
878057fe16a4f4bcdf4e3cf5e28c5e5686da8f24ebb03ced117b34a3f76571aa
-
SHA512
0264ab652876cf84616e713e9e7709679e16a43a9d4d8b2624dc0dfe417eb21925a12f07ef2beff8e712570dc9e5a3777aaf221267abe8e977dde7eb64ac7024
Score
10/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 11 1688 wscript.exe 13 1688 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uspstracker.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uspstracker.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uspstracker = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\uspstracker.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\uspstracker = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\uspstracker.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uspstracker = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\uspstracker.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\uspstracker = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\uspstracker.js\"" wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 13 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 12/10/2021|JavaScript-v3.4|DE:Germany -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3368 powershell.exe 3368 powershell.exe 3368 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3368 powershell.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1252 wrote to memory of 1688 1252 wscript.exe 71 PID 1252 wrote to memory of 1688 1252 wscript.exe 71
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\uspstracker.js1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\uspstracker.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3368