Analysis
-
max time kernel
149s -
max time network
179s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
18/10/2021, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
PO 21.18.0047 -(APPROVAL).js
Resource
win7-en-20210920
General
-
Target
PO 21.18.0047 -(APPROVAL).js
-
Size
45KB
-
MD5
8547af690a9b533d6acd08360f5b18d5
-
SHA1
fe393629e5df70bcfef741a70432af6c6a528b27
-
SHA256
e61713ffb39c48f5a162cbd0635b869bbd9b318ee3ac47a5a62490b572752b7a
-
SHA512
7dcab08f69aaefd585a31cf3636a6fe252a9efa18dd5e587f269ea5ccb8648a5daaa4c9302bc2a22f35fe48ac590a07b1192d7aed7eb7b2badb801b39b37552d
Malware Config
Extracted
wshrat
http://jahblessrtd4ever.home-webserver.de:1604
Signatures
-
suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
-
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
-
Blocklisted process makes network request 64 IoCs
flow pid Process 11 1548 wscript.exe 12 596 wscript.exe 13 660 wscript.exe 14 1548 wscript.exe 16 596 wscript.exe 18 660 wscript.exe 19 1548 wscript.exe 22 1548 wscript.exe 25 596 wscript.exe 26 660 wscript.exe 29 1548 wscript.exe 31 596 wscript.exe 32 660 wscript.exe 35 1548 wscript.exe 37 1548 wscript.exe 40 660 wscript.exe 41 596 wscript.exe 42 1548 wscript.exe 44 1548 wscript.exe 47 660 wscript.exe 49 596 wscript.exe 52 1548 wscript.exe 54 596 wscript.exe 55 660 wscript.exe 57 1548 wscript.exe 59 1548 wscript.exe 62 596 wscript.exe 63 660 wscript.exe 66 1548 wscript.exe 67 1548 wscript.exe 69 596 wscript.exe 70 660 wscript.exe 74 1548 wscript.exe 77 660 wscript.exe 79 596 wscript.exe 80 1548 wscript.exe 82 1548 wscript.exe 84 660 wscript.exe 86 596 wscript.exe 87 1548 wscript.exe 90 1548 wscript.exe 93 660 wscript.exe 94 596 wscript.exe 97 1548 wscript.exe 100 660 wscript.exe 101 596 wscript.exe 102 1548 wscript.exe 105 1548 wscript.exe 107 596 wscript.exe 109 660 wscript.exe 110 1548 wscript.exe 112 596 wscript.exe 114 1548 wscript.exe 117 660 wscript.exe 120 1548 wscript.exe 122 596 wscript.exe 123 660 wscript.exe 126 1548 wscript.exe 127 1548 wscript.exe 130 596 wscript.exe 132 660 wscript.exe 134 1548 wscript.exe 135 596 wscript.exe 137 660 wscript.exe -
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sURhETJCuW.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sURhETJCuW.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sURhETJCuW.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sURhETJCuW.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO 21.18.0047 -(APPROVAL).js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO 21.18.0047 -(APPROVAL).js wscript.exe -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO 21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO 21.18.0047 -(APPROVAL).js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\sURhETJCuW.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\sURhETJCuW.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO 21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO 21.18.0047 -(APPROVAL).js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO 21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO 21.18.0047 -(APPROVAL).js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO 21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO 21.18.0047 -(APPROVAL).js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 29 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 57 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 126 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 52 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 74 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 87 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 102 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 134 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 44 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 80 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 127 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 29 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 59 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 82 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 97 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 110 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 120 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 19 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 42 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 90 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 139 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 11 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 66 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 114 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 14 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 22 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 37 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 67 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 35 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript HTTP User-Agent header 105 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/10/2021|JavaScript -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1720 wrote to memory of 596 1720 wscript.exe 27 PID 1720 wrote to memory of 596 1720 wscript.exe 27 PID 1720 wrote to memory of 596 1720 wscript.exe 27 PID 1720 wrote to memory of 1548 1720 wscript.exe 28 PID 1720 wrote to memory of 1548 1720 wscript.exe 28 PID 1720 wrote to memory of 1548 1720 wscript.exe 28 PID 1548 wrote to memory of 660 1548 wscript.exe 29 PID 1548 wrote to memory of 660 1548 wscript.exe 29 PID 1548 wrote to memory of 660 1548 wscript.exe 29
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\PO 21.18.0047 -(APPROVAL).js"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\sURhETJCuW.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:596
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PO 21.18.0047 -(APPROVAL).js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\sURhETJCuW.js"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:660
-
-