Analysis
- max time kernel
155s - max time network
171s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
30/01/2022, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
RFQ2019240611111111111111_ENQUIRY19995C_PDF.js
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ2019240611111111111111_ENQUIRY19995C_PDF.js
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target RFQ2019240611111111111111_ENQUIRY19995C_PDF.js
- Size 104KB
- Sample220130-tap6aaece3
- SHA256 4eb6e69e7df76b5e84ecc4dc6f569fe2ad0f9763fc015014c2b23aa1c82f7332
- MD5 3e1d45dd6fef116c4a45cc81997027dc
- SHA1 a2cd3a0ecc900664510a9c3e2ff00faa943d3d6b
- SHA512 4d9052a10888af2c0feb5ec301681736b3c3374e84733d5edef5f7d026ab951b1e69760c72e53fc904b58733ea0fb680787980e0a7aacbc3051be85a34df3fd4
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
wshrat
C2
-
http://unknownsoft.duckdns.org:7755
Signatures
- Blocklisted process makes network request 20 IoCs
flow pid Process 11 4028 wscript.exe 21 4028 wscript.exe 23 4028 wscript.exe 25 4028 wscript.exe 27 4028 wscript.exe 29 4028 wscript.exe 31 4028 wscript.exe 34 4028 wscript.exe 36 4028 wscript.exe 38 4028 wscript.exe 40 4028 wscript.exe 46 4028 wscript.exe 49 4028 wscript.exe 51 4028 wscript.exe 53 4028 wscript.exe 55 4028 wscript.exe 58 4028 wscript.exe 60 4028 wscript.exe 62 4028 wscript.exe 64 4028 wscript.exe - Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gfjtkqqyNj.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gfjtkqqyNj.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ2019240611111111111111_ENQUIRY19995C_PDF.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RFQ2019240611111111111111_ENQUIRY19995C_PDF.js wscript.exe - Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RFQ2019240611111111111111_ENQUIRY19995C_PDF = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ2019240611111111111111_ENQUIRY19995C_PDF.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gfjtkqqyNj = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\gfjtkqqyNj.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\RFQ2019240611111111111111_ENQUIRY19995C_PDF = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ2019240611111111111111_ENQUIRY19995C_PDF.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RFQ2019240611111111111111_ENQUIRY19995C_PDF = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ2019240611111111111111_ENQUIRY19995C_PDF.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\RFQ2019240611111111111111_ENQUIRY19995C_PDF = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\RFQ2019240611111111111111_ENQUIRY19995C_PDF.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\gfjtkqqyNj = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\gfjtkqqyNj.js\"" wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Script User-Agent 20 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 11 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 27 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 60 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 62 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 23 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 46 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 49 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 55 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 58 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 34 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 38 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 40 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 51 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 53 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 64 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 21 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 25 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 29 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 31 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 HTTP User-Agent header 36 WSHRAT|2C782127|EZNBLWLT|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 10/12/2021|JavaScript-v1.3 - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2772 wrote to memory of 4028 2772 wscript.exe 70 PID 2772 wrote to memory of 4028 2772 wscript.exe 70 PID 2772 wrote to memory of 620 2772 wscript.exe 72 PID 2772 wrote to memory of 620 2772 wscript.exe 72 PID 620 wrote to memory of 1396 620 wscript.exe 73 PID 620 wrote to memory of 1396 620 wscript.exe 73
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ2019240611111111111111_ENQUIRY19995C_PDF.js1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\gfjtkqqyNj.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4028
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\RFQ2019240611111111111111_ENQUIRY19995C_PDF.js"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\gfjtkqqyNj.js"3⤵PID:1396
-
-