Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2022, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
SIUCI ORDER.js
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
SIUCI ORDER.js
Resource
win10v2004-20220901-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
SIUCI ORDER.js
-
Size
38KB
-
MD5
0aacaf9bf1e78783b3e509986061f7e2
-
SHA1
f9e45bbbd3a6f06472d99e0422b2a749c3b2ff67
-
SHA256
484410bc273d5c56528ebc42e0ae23e5b3af00a56a5abf6c66ac3df5d80b62e9
-
SHA512
58eabe5da6b6b83c2640a1827e69fb8007cc4b08dddab97a726c990d05850204a770e47168b26f5c74c9231f2739b338a66b363a1a9630e1791fd8d15b802293
-
SSDEEP
384:MS8D/T5zKRkowoXxlgYj+grrvtbzUSbJsiXYhRCBvMki6s8emZGoD45uyrtDGrM3:eDx0NFXku+aCp606su45Nt9QnY5qzC
Score
10/10
Malware Config
Extracted
Family
wshrat
C2
http://goods.camdvr.org:2888
Signatures
-
Blocklisted process makes network request 60 IoCs
flow pid Process 13 2328 wscript.exe 14 2292 wscript.exe 16 5024 wscript.exe 37 5024 wscript.exe 38 2328 wscript.exe 39 2292 wscript.exe 45 5024 wscript.exe 46 5024 wscript.exe 47 2292 wscript.exe 48 2328 wscript.exe 49 5024 wscript.exe 51 2292 wscript.exe 52 2328 wscript.exe 58 5024 wscript.exe 62 5024 wscript.exe 71 2328 wscript.exe 72 2292 wscript.exe 75 5024 wscript.exe 76 5024 wscript.exe 77 2328 wscript.exe 78 2292 wscript.exe 81 5024 wscript.exe 82 2328 wscript.exe 83 2292 wscript.exe 84 5024 wscript.exe 88 5024 wscript.exe 90 2328 wscript.exe 91 2292 wscript.exe 92 5024 wscript.exe 93 5024 wscript.exe 94 2292 wscript.exe 95 2328 wscript.exe 96 5024 wscript.exe 97 5024 wscript.exe 98 2292 wscript.exe 99 2328 wscript.exe 100 5024 wscript.exe 101 2292 wscript.exe 102 2328 wscript.exe 103 5024 wscript.exe 104 5024 wscript.exe 105 2292 wscript.exe 106 2328 wscript.exe 107 5024 wscript.exe 108 5024 wscript.exe 109 2292 wscript.exe 110 2328 wscript.exe 111 5024 wscript.exe 112 2292 wscript.exe 113 2328 wscript.exe 114 5024 wscript.exe 115 5024 wscript.exe 116 2292 wscript.exe 117 2328 wscript.exe 118 5024 wscript.exe 119 5024 wscript.exe 120 2292 wscript.exe 121 2328 wscript.exe 122 5024 wscript.exe 123 5024 wscript.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SIUCI ORDER.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NWVXVgmjNy.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NWVXVgmjNy.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NWVXVgmjNy.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SIUCI ORDER.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIUCI ORDER = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SIUCI ORDER.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIUCI ORDER = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SIUCI ORDER.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIUCI ORDER = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SIUCI ORDER.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SIUCI ORDER = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SIUCI ORDER.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 28 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 115 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 49 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 76 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 45 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 88 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 92 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 107 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 37 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 114 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 122 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 123 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 84 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 93 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 118 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 119 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 46 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 111 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 96 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 103 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 104 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 108 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 16 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 58 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 62 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 75 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 81 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 97 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript HTTP User-Agent header 100 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 21/9/2022|JavaScript -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2328 2388 wscript.exe 84 PID 2388 wrote to memory of 2328 2388 wscript.exe 84 PID 2388 wrote to memory of 5024 2388 wscript.exe 85 PID 2388 wrote to memory of 5024 2388 wscript.exe 85 PID 5024 wrote to memory of 2292 5024 wscript.exe 87 PID 5024 wrote to memory of 2292 5024 wscript.exe 87
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\SIUCI ORDER.js"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\NWVXVgmjNy.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:2328
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\SIUCI ORDER.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\NWVXVgmjNy.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:2292
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5dbc70d6189c016294324160a3aae590c
SHA134cc078ad2e4ed26e70b8d61b1abf8df62f64800
SHA256e2c2384c338bd09861a8400b3d717dacdb383ed4d2b06cad0e0cc3cf32b0fe98
SHA512ca01dcf3cadf2b2731f45f71d6eafdc6258c2f898db819a0cc34da45835e497b0b922c88f6b16b21775a3d7feba05f497fe7eea31d946896b266f029f1fd92b1
-
Filesize
38KB
MD50aacaf9bf1e78783b3e509986061f7e2
SHA1f9e45bbbd3a6f06472d99e0422b2a749c3b2ff67
SHA256484410bc273d5c56528ebc42e0ae23e5b3af00a56a5abf6c66ac3df5d80b62e9
SHA51258eabe5da6b6b83c2640a1827e69fb8007cc4b08dddab97a726c990d05850204a770e47168b26f5c74c9231f2739b338a66b363a1a9630e1791fd8d15b802293
-
Filesize
5KB
MD5dbc70d6189c016294324160a3aae590c
SHA134cc078ad2e4ed26e70b8d61b1abf8df62f64800
SHA256e2c2384c338bd09861a8400b3d717dacdb383ed4d2b06cad0e0cc3cf32b0fe98
SHA512ca01dcf3cadf2b2731f45f71d6eafdc6258c2f898db819a0cc34da45835e497b0b922c88f6b16b21775a3d7feba05f497fe7eea31d946896b266f029f1fd92b1
-
Filesize
5KB
MD5dbc70d6189c016294324160a3aae590c
SHA134cc078ad2e4ed26e70b8d61b1abf8df62f64800
SHA256e2c2384c338bd09861a8400b3d717dacdb383ed4d2b06cad0e0cc3cf32b0fe98
SHA512ca01dcf3cadf2b2731f45f71d6eafdc6258c2f898db819a0cc34da45835e497b0b922c88f6b16b21775a3d7feba05f497fe7eea31d946896b266f029f1fd92b1
-
Filesize
38KB
MD50aacaf9bf1e78783b3e509986061f7e2
SHA1f9e45bbbd3a6f06472d99e0422b2a749c3b2ff67
SHA256484410bc273d5c56528ebc42e0ae23e5b3af00a56a5abf6c66ac3df5d80b62e9
SHA51258eabe5da6b6b83c2640a1827e69fb8007cc4b08dddab97a726c990d05850204a770e47168b26f5c74c9231f2739b338a66b363a1a9630e1791fd8d15b802293