Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-06-2022 08:25
Static task
static1
Behavioral task
behavioral1
Sample
Documents for your perusal.js
Resource
win7-20220414-en
General
-
Target
Documents for your perusal.js
-
Size
102KB
-
MD5
1b74efa2c0b35138eca8ecdfa3eba6e0
-
SHA1
e324b86548391b74f204ee8f338aaf346c8f041e
-
SHA256
acbd5ccfb8d60783405dd96a626ef0f1752b1676fbe813e1b95a592229598a49
-
SHA512
3e2555900a56cbd4c2b160c034700818a7a7397eed49ee3d1d3c47b72dedc435ee42789992947c52e62327b26cdf5f8ccd7fc37c45d28f56d2d05b5a13feebbd
Malware Config
Extracted
wshrat
http://79.134.225.5:8443
Signatures
-
suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
-
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
-
Blocklisted process makes network request 40 IoCs
Processes:
wscript.exewscript.exeflow pid process 6 5048 wscript.exe 7 3700 wscript.exe 12 5048 wscript.exe 13 3700 wscript.exe 14 5048 wscript.exe 19 5048 wscript.exe 20 5048 wscript.exe 27 5048 wscript.exe 34 5048 wscript.exe 35 3700 wscript.exe 36 5048 wscript.exe 37 5048 wscript.exe 38 3700 wscript.exe 41 5048 wscript.exe 44 3700 wscript.exe 45 5048 wscript.exe 48 5048 wscript.exe 49 3700 wscript.exe 50 5048 wscript.exe 51 5048 wscript.exe 52 3700 wscript.exe 53 3700 wscript.exe 54 5048 wscript.exe 55 5048 wscript.exe 56 3700 wscript.exe 57 5048 wscript.exe 58 5048 wscript.exe 59 3700 wscript.exe 60 5048 wscript.exe 61 3700 wscript.exe 62 5048 wscript.exe 63 5048 wscript.exe 64 3700 wscript.exe 65 5048 wscript.exe 66 5048 wscript.exe 67 3700 wscript.exe 68 5048 wscript.exe 69 3700 wscript.exe 70 5048 wscript.exe 71 5048 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Documents for your perusal.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Documents for your perusal.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PIyMVuMvgS.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PIyMVuMvgS.js wscript.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
wscript.exewscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Documents for your perusal = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Documents for your perusal.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Documents for your perusal = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Documents for your perusal.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\PIyMVuMvgS.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 26 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 55 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 68 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 71 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 37 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 41 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 54 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 34 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 36 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 48 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 58 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 62 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 14 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 20 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 27 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 70 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 51 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 57 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 63 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 65 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 6 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 19 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 45 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 66 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 12 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 50 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript HTTP User-Agent header 60 WSHRAT|E27E20AC|TWJYXOUL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 17/6/2022|JavaScript -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
wscript.exedescription pid process target process PID 5048 wrote to memory of 3700 5048 wscript.exe wscript.exe PID 5048 wrote to memory of 3700 5048 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Documents for your perusal.js"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PIyMVuMvgS.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\PIyMVuMvgS.jsFilesize
28KB
MD5204ace6f24d40310b7ad4ba7c158230b
SHA1c97cb43e319376c167dd51712d0e538477791786
SHA25645e553d318f844c7b08b1255965d0263bb6f93ead4e870ca5059e43b73eb9a01
SHA512a4ef9a7e6cd0123aa760dfe1f87c8d67a846918b59ac2bc393cf63e7f31b675fd979658ab6a9c60ceaeeb4c1a8e8ed2cccf2033ded22a544489e1ea597e167e2
-
memory/3700-130-0x0000000000000000-mapping.dmp