Analysis
- max time kernel
146s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
29/09/2022, 11:55
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Documents.js
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Shipping Documents.js
Resource
win10v2004-20220901-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target Shipping Documents.js
- Size 47KB
- Sample220929-n3f57abfgp
- SHA256 76c7451f27cd07c3bbe48b7378ed85047036c65fed201128b892545ff8e46a5a
- MD5 4d4480b2a363d66f2647d10d978c085a
- SHA1 3f9d64be86691d734d8d7018ff0436b615e7effc
- SHA512 3425b770417baabe9bfffe85f7ad084547fd5b10b53c0a7b05b65c2934412cdb24752db648f851447516ceb46de5bb4e8986688cade03a52a9ca232da60cb63b
- SSDEEP 768:8tZ8oMh8ycJrJWRJpBWefOydp5pb5aNs9SVY4D3HaTvICf99EWrWExBSSLtLG:8tZ8o28yKrJ+HWQOydp5pb5aNs90Y4DP
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
wshrat
C2
-
http://praisejames.giize.com:4142
Signatures
- Blocklisted process makes network request 40 IoCs
flow pid Process 7 3816 wscript.exe 8 4428 wscript.exe 10 552 wscript.exe 32 552 wscript.exe 37 552 wscript.exe 40 552 wscript.exe 41 552 wscript.exe 42 552 wscript.exe 43 3816 wscript.exe 44 4428 wscript.exe 53 552 wscript.exe 59 552 wscript.exe 60 552 wscript.exe 63 552 wscript.exe 65 552 wscript.exe 66 4428 wscript.exe 67 3816 wscript.exe 69 552 wscript.exe 70 552 wscript.exe 72 552 wscript.exe 73 552 wscript.exe 74 552 wscript.exe 75 4428 wscript.exe 76 3816 wscript.exe 77 552 wscript.exe 78 552 wscript.exe 79 552 wscript.exe 80 552 wscript.exe 81 552 wscript.exe 82 552 wscript.exe 83 3816 wscript.exe 84 4428 wscript.exe 85 552 wscript.exe 86 552 wscript.exe 87 552 wscript.exe 88 552 wscript.exe 89 552 wscript.exe 90 3816 wscript.exe 91 4428 wscript.exe 92 552 wscript.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe - Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEFneLogGT.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Documents.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEFneLogGT.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Documents.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEFneLogGT.js wscript.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shipping Documents = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Shipping Documents.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shipping Documents = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Shipping Documents.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shipping Documents = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Shipping Documents.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shipping Documents = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Shipping Documents.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Script User-Agent 28 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 10 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 63 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 78 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 92 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 42 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 59 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 69 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 72 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 73 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 82 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 85 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 70 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 80 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 41 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 79 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 86 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 32 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 40 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 53 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 65 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 77 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 81 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 87 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 88 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 37 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 60 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 74 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 89 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 29/9/2022|JavaScript - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3036 wrote to memory of 3816 3036 wscript.exe 86 PID 3036 wrote to memory of 3816 3036 wscript.exe 86 PID 3036 wrote to memory of 552 3036 wscript.exe 87 PID 3036 wrote to memory of 552 3036 wscript.exe 87 PID 552 wrote to memory of 4428 552 wscript.exe 88 PID 552 wrote to memory of 4428 552 wscript.exe 88
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Shipping Documents.js"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\NEFneLogGT.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:3816
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Shipping Documents.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\NEFneLogGT.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:4428
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEFneLogGT.js
- Size 8KB
- SHA256 8fda4f0487b7a6c80ae2d524ab571f0819b229e9b453b0aa91ea67fdbffbcfb7
- MD5 f835554d0a082a0f29fceb25ca077d3a
- SHA1 3da72690ae950602516c471e6732810d484c9c4c
- SHA512 271a7870d427deeeebab5c04de4a39d071571ffeabb32b7fa8539c0f7269548a76c6a0973a49b951db3792bed59ad97a51584914a042324d46db43fe342479b1
- SSDEEP 192:ynUwAgTCYu+fOpmgiwNrfNIBM+RkMHB5GSvIxoGK324tNG:8UwAdLpJrfWBhkMHbGSLtTtNG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Documents.js
- Size 47KB
- SHA256 76c7451f27cd07c3bbe48b7378ed85047036c65fed201128b892545ff8e46a5a
- MD5 4d4480b2a363d66f2647d10d978c085a
- SHA1 3f9d64be86691d734d8d7018ff0436b615e7effc
- SHA512 3425b770417baabe9bfffe85f7ad084547fd5b10b53c0a7b05b65c2934412cdb24752db648f851447516ceb46de5bb4e8986688cade03a52a9ca232da60cb63b
- SSDEEP 768:8tZ8oMh8ycJrJWRJpBWefOydp5pb5aNs9SVY4D3HaTvICf99EWrWExBSSLtLG:8tZ8o28yKrJ+HWQOydp5pb5aNs90Y4DP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\NEFneLogGT.js
- Size 8KB
- SHA256 8fda4f0487b7a6c80ae2d524ab571f0819b229e9b453b0aa91ea67fdbffbcfb7
- MD5 f835554d0a082a0f29fceb25ca077d3a
- SHA1 3da72690ae950602516c471e6732810d484c9c4c
- SHA512 271a7870d427deeeebab5c04de4a39d071571ffeabb32b7fa8539c0f7269548a76c6a0973a49b951db3792bed59ad97a51584914a042324d46db43fe342479b1
- SSDEEP 192:ynUwAgTCYu+fOpmgiwNrfNIBM+RkMHB5GSvIxoGK324tNG:8UwAdLpJrfWBhkMHbGSLtTtNG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\NEFneLogGT.js
- Size 8KB
- SHA256 8fda4f0487b7a6c80ae2d524ab571f0819b229e9b453b0aa91ea67fdbffbcfb7
- MD5 f835554d0a082a0f29fceb25ca077d3a
- SHA1 3da72690ae950602516c471e6732810d484c9c4c
- SHA512 271a7870d427deeeebab5c04de4a39d071571ffeabb32b7fa8539c0f7269548a76c6a0973a49b951db3792bed59ad97a51584914a042324d46db43fe342479b1
- SSDEEP 192:ynUwAgTCYu+fOpmgiwNrfNIBM+RkMHB5GSvIxoGK324tNG:8UwAdLpJrfWBhkMHbGSLtTtNG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Shipping Documents.js
- Size 47KB
- SHA256 76c7451f27cd07c3bbe48b7378ed85047036c65fed201128b892545ff8e46a5a
- MD5 4d4480b2a363d66f2647d10d978c085a
- SHA1 3f9d64be86691d734d8d7018ff0436b615e7effc
- SHA512 3425b770417baabe9bfffe85f7ad084547fd5b10b53c0a7b05b65c2934412cdb24752db648f851447516ceb46de5bb4e8986688cade03a52a9ca232da60cb63b
- SSDEEP 768:8tZ8oMh8ycJrJWRJpBWefOydp5pb5aNs9SVY4D3HaTvICf99EWrWExBSSLtLG:8tZ8o28yKrJ+HWQOydp5pb5aNs90Y4DP
- MD5 SHA1 SHA512 SSDEEP