Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21-09-2022 13:13
Static task
static1
Behavioral task
behavioral1
Sample
SIUCI ORDER.js
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
SIUCI ORDER.js
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
SIUCI ORDER.js
-
Size
38KB
-
MD5
0aacaf9bf1e78783b3e509986061f7e2
-
SHA1
f9e45bbbd3a6f06472d99e0422b2a749c3b2ff67
-
SHA256
484410bc273d5c56528ebc42e0ae23e5b3af00a56a5abf6c66ac3df5d80b62e9
-
SHA512
58eabe5da6b6b83c2640a1827e69fb8007cc4b08dddab97a726c990d05850204a770e47168b26f5c74c9231f2739b338a66b363a1a9630e1791fd8d15b802293
-
SSDEEP
384:MS8D/T5zKRkowoXxlgYj+grrvtbzUSbJsiXYhRCBvMki6s8emZGoD45uyrtDGrM3:eDx0NFXku+aCp606su45Nt9QnY5qzC
Malware Config
Extracted
wshrat
http://goods.camdvr.org:2888
Signatures
-
Blocklisted process makes network request 57 IoCs
flow pid Process 10 1368 wscript.exe 11 1492 wscript.exe 12 1344 wscript.exe 13 1344 wscript.exe 15 1492 wscript.exe 17 1368 wscript.exe 18 1344 wscript.exe 20 1344 wscript.exe 22 1492 wscript.exe 24 1368 wscript.exe 27 1344 wscript.exe 29 1368 wscript.exe 30 1492 wscript.exe 32 1344 wscript.exe 36 1344 wscript.exe 37 1368 wscript.exe 39 1492 wscript.exe 40 1344 wscript.exe 42 1492 wscript.exe 44 1368 wscript.exe 45 1344 wscript.exe 50 1344 wscript.exe 52 1492 wscript.exe 53 1368 wscript.exe 54 1344 wscript.exe 56 1368 wscript.exe 58 1492 wscript.exe 59 1344 wscript.exe 61 1344 wscript.exe 63 1368 wscript.exe 65 1492 wscript.exe 69 1344 wscript.exe 70 1368 wscript.exe 71 1492 wscript.exe 73 1344 wscript.exe 76 1344 wscript.exe 78 1368 wscript.exe 80 1492 wscript.exe 81 1344 wscript.exe 84 1344 wscript.exe 86 1492 wscript.exe 87 1368 wscript.exe 91 1344 wscript.exe 92 1368 wscript.exe 93 1492 wscript.exe 95 1344 wscript.exe 97 1344 wscript.exe 99 1368 wscript.exe 100 1492 wscript.exe 102 1344 wscript.exe 104 1368 wscript.exe 106 1492 wscript.exe 107 1344 wscript.exe 111 1344 wscript.exe 114 1368 wscript.exe 115 1492 wscript.exe 117 1344 wscript.exe -
Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NWVXVgmjNy.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SIUCI ORDER.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NWVXVgmjNy.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NWVXVgmjNy.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SIUCI ORDER.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIUCI ORDER = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SIUCI ORDER.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\SIUCI ORDER = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SIUCI ORDER.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIUCI ORDER = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SIUCI ORDER.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\SIUCI ORDER = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SIUCI ORDER.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 25 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 111 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 20 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 36 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 40 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 45 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 50 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 84 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 102 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 27 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 76 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 107 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 61 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 73 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 97 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 117 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 81 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 12 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 13 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 18 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 32 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 54 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 59 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 69 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 91 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 95 WSHRAT|BC40DA2B|GRXNNIIE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2022|JavaScript -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1492 1096 wscript.exe 28 PID 1096 wrote to memory of 1492 1096 wscript.exe 28 PID 1096 wrote to memory of 1492 1096 wscript.exe 28 PID 1096 wrote to memory of 1344 1096 wscript.exe 29 PID 1096 wrote to memory of 1344 1096 wscript.exe 29 PID 1096 wrote to memory of 1344 1096 wscript.exe 29 PID 1344 wrote to memory of 1368 1344 wscript.exe 31 PID 1344 wrote to memory of 1368 1344 wscript.exe 31 PID 1344 wrote to memory of 1368 1344 wscript.exe 31
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\SIUCI ORDER.js"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\NWVXVgmjNy.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:1492
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\SIUCI ORDER.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\NWVXVgmjNy.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:1368
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5dbc70d6189c016294324160a3aae590c
SHA134cc078ad2e4ed26e70b8d61b1abf8df62f64800
SHA256e2c2384c338bd09861a8400b3d717dacdb383ed4d2b06cad0e0cc3cf32b0fe98
SHA512ca01dcf3cadf2b2731f45f71d6eafdc6258c2f898db819a0cc34da45835e497b0b922c88f6b16b21775a3d7feba05f497fe7eea31d946896b266f029f1fd92b1
-
Filesize
38KB
MD50aacaf9bf1e78783b3e509986061f7e2
SHA1f9e45bbbd3a6f06472d99e0422b2a749c3b2ff67
SHA256484410bc273d5c56528ebc42e0ae23e5b3af00a56a5abf6c66ac3df5d80b62e9
SHA51258eabe5da6b6b83c2640a1827e69fb8007cc4b08dddab97a726c990d05850204a770e47168b26f5c74c9231f2739b338a66b363a1a9630e1791fd8d15b802293
-
Filesize
5KB
MD5dbc70d6189c016294324160a3aae590c
SHA134cc078ad2e4ed26e70b8d61b1abf8df62f64800
SHA256e2c2384c338bd09861a8400b3d717dacdb383ed4d2b06cad0e0cc3cf32b0fe98
SHA512ca01dcf3cadf2b2731f45f71d6eafdc6258c2f898db819a0cc34da45835e497b0b922c88f6b16b21775a3d7feba05f497fe7eea31d946896b266f029f1fd92b1
-
Filesize
5KB
MD5dbc70d6189c016294324160a3aae590c
SHA134cc078ad2e4ed26e70b8d61b1abf8df62f64800
SHA256e2c2384c338bd09861a8400b3d717dacdb383ed4d2b06cad0e0cc3cf32b0fe98
SHA512ca01dcf3cadf2b2731f45f71d6eafdc6258c2f898db819a0cc34da45835e497b0b922c88f6b16b21775a3d7feba05f497fe7eea31d946896b266f029f1fd92b1
-
Filesize
38KB
MD50aacaf9bf1e78783b3e509986061f7e2
SHA1f9e45bbbd3a6f06472d99e0422b2a749c3b2ff67
SHA256484410bc273d5c56528ebc42e0ae23e5b3af00a56a5abf6c66ac3df5d80b62e9
SHA51258eabe5da6b6b83c2640a1827e69fb8007cc4b08dddab97a726c990d05850204a770e47168b26f5c74c9231f2739b338a66b363a1a9630e1791fd8d15b802293