Analysis
-
max time kernel
156s -
max time network
159s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
14/10/2021, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
Scan00351.js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Scan00351.js
Resource
win10-en-20210920
General
-
Target
Scan00351.js
-
Size
1.1MB
-
MD5
4de228a23fa5bf52c82ec784001163ee
-
SHA1
027657531c6c03281fb87b8b026200b25c6cf87a
-
SHA256
2945b78f1df308e1e0c184b47050eb5143c1daadd57ea8eb5eadc4730eaa2f2a
-
SHA512
0cc24f29b44382869c17a04ffdce0ac243ca67468d92a149260b7bdfb126f3f1257925ba78fbfc7ebc9183a4f27cabe69560c66cdffcfc95bec7b03a5df41799
Malware Config
Extracted
wshrat
http://147.182.241.104:7121
Signatures
-
Blocklisted process makes network request 27 IoCs
flow pid Process 2 1996 wscript.exe 6 1996 wscript.exe 7 1996 wscript.exe 8 1996 wscript.exe 9 1996 wscript.exe 11 1996 wscript.exe 12 1996 wscript.exe 13 1996 wscript.exe 17 1996 wscript.exe 18 1996 wscript.exe 19 1996 wscript.exe 21 1996 wscript.exe 22 1996 wscript.exe 23 1996 wscript.exe 25 1996 wscript.exe 26 1996 wscript.exe 27 1996 wscript.exe 29 1996 wscript.exe 30 1996 wscript.exe 31 1996 wscript.exe 33 1996 wscript.exe 34 1996 wscript.exe 35 1996 wscript.exe 37 1996 wscript.exe 38 1996 wscript.exe 39 1996 wscript.exe 41 1996 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scan00351.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scan00351.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Scan00351 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Scan00351.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Scan00351 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Scan00351.js\"" wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 26 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 11 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 13 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 30 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 41 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 7 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 8 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 9 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 19 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 21 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 22 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 25 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 27 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 31 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 29 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 23 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 26 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 39 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 17 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 18 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 33 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 34 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 35 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 37 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 38 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 12 WSHRAT|40707513|QWOCTUPM|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 14/10/2021|JavaScript-v3.4|NL:Netherlands