Analysis
-
max time kernel
154s -
max time network
157s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
10/10/2021, 11:51
Static task
static1
Behavioral task
behavioral1
Sample
3151f194fcfe3b210732d3f6bed59cbd.js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
3151f194fcfe3b210732d3f6bed59cbd.js
Resource
win10-en-20210920
General
-
Target
3151f194fcfe3b210732d3f6bed59cbd.js
-
Size
1.1MB
-
MD5
3151f194fcfe3b210732d3f6bed59cbd
-
SHA1
84d181e892c2c51d29c70daa7f785aa4b9a256bd
-
SHA256
878057fe16a4f4bcdf4e3cf5e28c5e5686da8f24ebb03ced117b34a3f76571aa
-
SHA512
0264ab652876cf84616e713e9e7709679e16a43a9d4d8b2624dc0dfe417eb21925a12f07ef2beff8e712570dc9e5a3777aaf221267abe8e977dde7eb64ac7024
Malware Config
Extracted
wshrat
http://gar373.ddns.net:3030
Signatures
-
Blocklisted process makes network request 26 IoCs
flow pid Process 4 612 wscript.exe 6 612 wscript.exe 7 612 wscript.exe 8 612 wscript.exe 10 612 wscript.exe 11 612 wscript.exe 14 612 wscript.exe 16 612 wscript.exe 17 612 wscript.exe 18 612 wscript.exe 20 612 wscript.exe 21 612 wscript.exe 22 612 wscript.exe 24 612 wscript.exe 25 612 wscript.exe 26 612 wscript.exe 28 612 wscript.exe 29 612 wscript.exe 30 612 wscript.exe 32 612 wscript.exe 33 612 wscript.exe 34 612 wscript.exe 36 612 wscript.exe 37 612 wscript.exe 38 612 wscript.exe 40 612 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3151f194fcfe3b210732d3f6bed59cbd.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3151f194fcfe3b210732d3f6bed59cbd.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\3151f194fcfe3b210732d3f6bed59cbd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3151f194fcfe3b210732d3f6bed59cbd.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3151f194fcfe3b210732d3f6bed59cbd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3151f194fcfe3b210732d3f6bed59cbd.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\3151f194fcfe3b210732d3f6bed59cbd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3151f194fcfe3b210732d3f6bed59cbd.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3151f194fcfe3b210732d3f6bed59cbd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3151f194fcfe3b210732d3f6bed59cbd.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\software\microsoft\windows\currentversion\run wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 25 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 40 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 20 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 21 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 11 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 16 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 22 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 25 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 28 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 29 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 6 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 10 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 30 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 32 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 33 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 34 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 36 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 14 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 26 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 17 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 18 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 24 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 37 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 38 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 7 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 8 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 10/10/2021|JavaScript-v3.4|NL:Netherlands -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1996 wrote to memory of 612 1996 wscript.exe 25 PID 1996 wrote to memory of 612 1996 wscript.exe 25 PID 1996 wrote to memory of 612 1996 wscript.exe 25
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\3151f194fcfe3b210732d3f6bed59cbd.js1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\3151f194fcfe3b210732d3f6bed59cbd.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:612
-