Analysis
- max time kernel
175s - max time network
193s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/02/2022, 00:47
Static task
static1
Behavioral task
behavioral1
Sample
Rechnung2498.js
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Rechnung2498.js
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target Rechnung2498.js
- Size 179KB
- Sample220208-a5gylsbcek
- SHA256 39f7abd459bda03744d7d1dfb7dd15b2204014d75f20d86a13789648d6f44b1d
- MD5 093aa4289d9d8d8315ab0ea9b306f0a0
- SHA1 0316c6e558148a10d0acf63bc84f53ca315b1acf
- SHA512 ddea7839a14759a27d17578850fb473f720bf911cb9d6e56c3e55a963eca51a85ae1706d2f8bca31b216fa7ef2457135dd1a198008203e6635cb73fd3df985f8
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- WSHRAT Payload 3 IoCs
resource yara_rule behavioral2/files/0x000300000001e79f-131.dat family_wshrat behavioral2/files/0x000300000001e79f-130.dat family_wshrat behavioral2/files/0x000400000001e7a0-132.dat family_wshrat - Blocklisted process makes network request 20 IoCs
flow pid Process 23 4956 wscript.exe 27 4956 wscript.exe 35 4956 wscript.exe 37 4956 wscript.exe 45 4956 wscript.exe 52 4956 wscript.exe 60 4956 wscript.exe 61 4956 wscript.exe 63 4956 wscript.exe 66 4956 wscript.exe 67 4956 wscript.exe 72 4956 wscript.exe 73 4956 wscript.exe 77 4956 wscript.exe 78 4956 wscript.exe 79 4956 wscript.exe 80 4956 wscript.exe 81 4956 wscript.exe 84 4956 wscript.exe 85 4956 wscript.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation wscript.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rechnung2498.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rechnung2498.js wscript.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rechnung2498 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Rechnung2498.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rechnung2498 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Rechnung2498.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rechnung2498 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Rechnung2498.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rechnung2498 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Rechnung2498.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 ip-api.com - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeShutdownPrivilege 3472 svchost.exe Token: SeCreatePagefilePrivilege 3472 svchost.exe Token: SeShutdownPrivilege 3472 svchost.exe Token: SeCreatePagefilePrivilege 3472 svchost.exe Token: SeShutdownPrivilege 3472 svchost.exe Token: SeCreatePagefilePrivilege 3472 svchost.exe Token: SeSecurityPrivilege 1296 TiWorker.exe Token: SeRestorePrivilege 1296 TiWorker.exe Token: SeBackupPrivilege 1296 TiWorker.exe Token: SeBackupPrivilege 1296 TiWorker.exe Token: SeRestorePrivilege 1296 TiWorker.exe Token: SeSecurityPrivilege 1296 TiWorker.exe Token: SeBackupPrivilege 1296 TiWorker.exe Token: SeRestorePrivilege 1296 TiWorker.exe Token: SeSecurityPrivilege 1296 TiWorker.exe Token: SeBackupPrivilege 1296 TiWorker.exe Token: SeRestorePrivilege 1296 TiWorker.exe Token: SeSecurityPrivilege 1296 TiWorker.exe Token: SeBackupPrivilege 1296 TiWorker.exe Token: SeRestorePrivilege 1296 TiWorker.exe Token: SeSecurityPrivilege 1296 TiWorker.exe Token: SeBackupPrivilege 1296 TiWorker.exe Token: SeRestorePrivilege 1296 TiWorker.exe Token: SeSecurityPrivilege 1296 TiWorker.exe Token: SeBackupPrivilege 1296 TiWorker.exe Token: SeRestorePrivilege 1296 TiWorker.exe Token: SeSecurityPrivilege 1296 TiWorker.exe Token: SeBackupPrivilege 1296 TiWorker.exe Token: SeRestorePrivilege 1296 TiWorker.exe Token: SeSecurityPrivilege 1296 TiWorker.exe Token: SeBackupPrivilege 1296 TiWorker.exe Token: SeRestorePrivilege 1296 TiWorker.exe Token: SeSecurityPrivilege 1296 TiWorker.exe Token: SeBackupPrivilege 1296 TiWorker.exe Token: SeRestorePrivilege 1296 TiWorker.exe Token: SeSecurityPrivilege 1296 TiWorker.exe Token: SeBackupPrivilege 1296 TiWorker.exe Token: SeRestorePrivilege 1296 TiWorker.exe Token: SeSecurityPrivilege 1296 TiWorker.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3220 wrote to memory of 4956 3220 wscript.exe 86 PID 3220 wrote to memory of 4956 3220 wscript.exe 86
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Rechnung2498.js1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Rechnung2498.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4956
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1296