Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11/10/2021, 13:08
Static task
static1
Behavioral task
behavioral1
Sample
uspstracker.js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
uspstracker.js
Resource
win10v20210408
General
-
Target
uspstracker.js
-
Size
1.1MB
-
MD5
3151f194fcfe3b210732d3f6bed59cbd
-
SHA1
84d181e892c2c51d29c70daa7f785aa4b9a256bd
-
SHA256
878057fe16a4f4bcdf4e3cf5e28c5e5686da8f24ebb03ced117b34a3f76571aa
-
SHA512
0264ab652876cf84616e713e9e7709679e16a43a9d4d8b2624dc0dfe417eb21925a12f07ef2beff8e712570dc9e5a3777aaf221267abe8e977dde7eb64ac7024
Malware Config
Extracted
wshrat
http://gar373.ddns.net:3030
Signatures
-
Blocklisted process makes network request 29 IoCs
flow pid Process 10 2660 wscript.exe 12 2660 wscript.exe 24 2660 wscript.exe 28 2660 wscript.exe 29 2660 wscript.exe 34 2660 wscript.exe 36 2660 wscript.exe 37 2660 wscript.exe 38 2660 wscript.exe 39 2660 wscript.exe 40 2660 wscript.exe 41 2660 wscript.exe 42 2660 wscript.exe 44 2660 wscript.exe 45 2660 wscript.exe 46 2660 wscript.exe 47 2660 wscript.exe 48 2660 wscript.exe 49 2660 wscript.exe 50 2660 wscript.exe 51 2660 wscript.exe 52 2660 wscript.exe 53 2660 wscript.exe 54 2660 wscript.exe 57 2660 wscript.exe 58 2660 wscript.exe 59 2660 wscript.exe 60 2660 wscript.exe 61 2660 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uspstracker.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uspstracker.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\uspstracker = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\uspstracker.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uspstracker = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\uspstracker.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\uspstracker = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\uspstracker.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uspstracker = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\uspstracker.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\software\microsoft\windows\currentversion\run wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 28 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 50 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 36 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 45 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 49 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 54 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 60 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 61 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 12 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 42 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 38 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 47 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 37 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 48 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 52 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 58 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 28 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 41 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 40 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 57 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 44 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 46 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 34 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 39 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 51 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 53 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 59 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 24 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 29 WSHRAT|3ED10BF6|GFBFPSXA|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 776 wrote to memory of 2660 776 wscript.exe 71 PID 776 wrote to memory of 2660 776 wscript.exe 71
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\uspstracker.js1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\uspstracker.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2660
-