Analysis
- max time kernel
150s - max time network
155s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
19/10/2021, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
CPVN - PO 1910450087085-03 - C.P Việt Nam - CPV-01.js
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target CPVN - PO 1910450087085-03 - C.P Việt Nam - CPV-01.js
- Size 45KB
- Sample211019-kceynagcfr
- SHA256 d52a0835e1845e89e134b1701d39b4f1fe4091814d9c1746f2f722599328dd13
- MD5 8c7d90878061ce94f70b41a3d2678379
- SHA1 7d08d5be9c64a49ccfeeb14aee806cb017d941db
- SHA512 e510040078a0dc4b305abaf1a6d33d44f871f77f91c90c721c810fbb629b3c633e44654193bebd9b4bf537b9d124696432f808bdfbc60daf7c49e206eadb0792
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
wshrat
C2
-
http://faxjohn01.dyn.ddnss.de:1251
Signatures
- suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
- suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
- Blocklisted process makes network request 64 IoCs
flow pid Process 11 528 wscript.exe 12 880 wscript.exe 13 524 wscript.exe 14 528 wscript.exe 16 524 wscript.exe 17 880 wscript.exe 19 528 wscript.exe 21 528 wscript.exe 23 880 wscript.exe 25 524 wscript.exe 28 528 wscript.exe 30 524 wscript.exe 31 880 wscript.exe 33 528 wscript.exe 35 528 wscript.exe 36 524 wscript.exe 39 880 wscript.exe 40 528 wscript.exe 41 528 wscript.exe 45 524 wscript.exe 46 880 wscript.exe 49 528 wscript.exe 51 524 wscript.exe 53 880 wscript.exe 54 528 wscript.exe 55 528 wscript.exe 59 880 wscript.exe 60 524 wscript.exe 61 528 wscript.exe 62 528 wscript.exe 64 880 wscript.exe 66 524 wscript.exe 69 528 wscript.exe 72 880 wscript.exe 73 524 wscript.exe 75 528 wscript.exe 76 528 wscript.exe 78 524 wscript.exe 79 880 wscript.exe 81 528 wscript.exe 83 528 wscript.exe 85 524 wscript.exe 87 880 wscript.exe 90 528 wscript.exe 92 524 wscript.exe 94 880 wscript.exe 95 528 wscript.exe 97 528 wscript.exe 99 524 wscript.exe 101 880 wscript.exe 102 528 wscript.exe 103 528 wscript.exe 106 524 wscript.exe 108 880 wscript.exe 111 528 wscript.exe 112 880 wscript.exe 115 524 wscript.exe 116 528 wscript.exe 117 528 wscript.exe 120 880 wscript.exe 122 524 wscript.exe 123 528 wscript.exe 124 524 wscript.exe 127 880 wscript.exe - Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fSHKTxYIwQ.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CPVN - PO 1910450087085-03 - C.P Việt Nam - CPV-01.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CPVN - PO 1910450087085-03 - C.P Việt Nam - CPV-01.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fSHKTxYIwQ.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fSHKTxYIwQ.js wscript.exe - Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\fSHKTxYIwQ.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\CPVN - PO 1910450087085-03 - C = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\CPVN - PO 1910450087085-03 - C.P Vi?t Nam - CPV-01.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CPVN - PO 1910450087085-03 - C = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\CPVN - PO 1910450087085-03 - C.P Vi?t Nam - CPV-01.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\fSHKTxYIwQ.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\CPVN - PO 1910450087085-03 - C = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\CPVN - PO 1910450087085-03 - C.P Vi?t Nam - CPV-01.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CPVN - PO 1910450087085-03 - C = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\CPVN - PO 1910450087085-03 - C.P Vi?t Nam - CPV-01.js\"" wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Script User-Agent 29 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 111 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 54 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 95 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 61 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 62 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 69 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 102 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 116 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 19 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 41 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 35 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 117 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 11 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 33 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 76 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 21 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 40 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 83 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 90 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 97 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 103 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 128 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 14 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 28 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 75 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 123 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 49 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 55 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript HTTP User-Agent header 81 WSHRAT|DCE526E0|JZCKHXIN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 19/10/2021|JavaScript - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1768 wrote to memory of 524 1768 wscript.exe 27 PID 1768 wrote to memory of 524 1768 wscript.exe 27 PID 1768 wrote to memory of 524 1768 wscript.exe 27 PID 1768 wrote to memory of 528 1768 wscript.exe 28 PID 1768 wrote to memory of 528 1768 wscript.exe 28 PID 1768 wrote to memory of 528 1768 wscript.exe 28 PID 528 wrote to memory of 880 528 wscript.exe 29 PID 528 wrote to memory of 880 528 wscript.exe 29 PID 528 wrote to memory of 880 528 wscript.exe 29
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\CPVN - PO 1910450087085-03 - C.P Việt Nam - CPV-01.js"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\fSHKTxYIwQ.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:524
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\CPVN - PO 1910450087085-03 - C.P Việt Nam - CPV-01.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\fSHKTxYIwQ.js"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:880
-
-