Analysis
- max time kernel
150s - max time network
153s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system - submitted
29/09/2022, 16:39
Static task
static1
Behavioral task
behavioral1
Sample
Swift Payment PENPO-0409SSI-032022.js
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Swift Payment PENPO-0409SSI-032022.js
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target Swift Payment PENPO-0409SSI-032022.js
- Size 47KB
- Sample220929-t563aabdf4
- SHA256 45c4cd068d5217d463f4f60ad7bebeb774943a89e86fa6b9b9da549351aea27d
- MD5 da29c4d1c35bd269018588612eeec23f
- SHA1 7b6f0f2bb0c3accc9a57ce5a550b50294d840e8a
- SHA512 8bdd018a72da202530e405c4a85e65105800deef216552c40dbc9aa12cac7e031a0a06a2f0d43f26ed5a6395e211c678f86d3b889a86e9b5b8bf8e6dc8408147
- SSDEEP 768:MW2cSmgnFw1qRNU5ab7/8MgPmdjVhL+DIpvbekXAmICm28ibK39BraLEfw5ErcBd:MW2bHnSM3U5o8FPmdjVhL+DIpvKkXAxk
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
wshrat
C2
-
http://jbd231.duckdns.org:2022
Signatures
- Blocklisted process makes network request 36 IoCs
flow pid Process 10 2028 wscript.exe 11 544 wscript.exe 12 1592 wscript.exe 13 2028 wscript.exe 15 2028 wscript.exe 17 2028 wscript.exe 20 2028 wscript.exe 22 2028 wscript.exe 25 544 wscript.exe 27 1592 wscript.exe 29 2028 wscript.exe 31 2028 wscript.exe 33 2028 wscript.exe 36 2028 wscript.exe 39 2028 wscript.exe 41 1592 wscript.exe 43 544 wscript.exe 44 2028 wscript.exe 47 2028 wscript.exe 49 2028 wscript.exe 51 2028 wscript.exe 56 2028 wscript.exe 58 544 wscript.exe 60 1592 wscript.exe 61 2028 wscript.exe 63 2028 wscript.exe 66 2028 wscript.exe 68 2028 wscript.exe 71 2028 wscript.exe 74 1592 wscript.exe 75 544 wscript.exe 77 2028 wscript.exe 79 2028 wscript.exe 81 2028 wscript.exe 84 2028 wscript.exe 87 2028 wscript.exe - Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Swift Payment PENPO-0409SSI-032022.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IhMiqhRopX.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IhMiqhRopX.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Swift Payment PENPO-0409SSI-032022.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IhMiqhRopX.js wscript.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Swift Payment PENPO-0409SSI-032022 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Swift Payment PENPO-0409SSI-032022.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Swift Payment PENPO-0409SSI-032022 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Swift Payment PENPO-0409SSI-032022.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Swift Payment PENPO-0409SSI-032022 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Swift Payment PENPO-0409SSI-032022.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Swift Payment PENPO-0409SSI-032022 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Swift Payment PENPO-0409SSI-032022.js\"" wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Script User-Agent 26 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 36 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 47 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 49 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 56 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 79 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 81 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 29 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 15 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 22 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 31 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 39 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 61 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 63 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 66 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 13 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 77 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 71 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 33 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 51 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 68 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 84 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 87 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 10 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 20 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 44 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript HTTP User-Agent header 17 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 29/9/2022|JavaScript - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1696 wrote to memory of 544 1696 wscript.exe 27 PID 1696 wrote to memory of 544 1696 wscript.exe 27 PID 1696 wrote to memory of 544 1696 wscript.exe 27 PID 1696 wrote to memory of 2028 1696 wscript.exe 28 PID 1696 wrote to memory of 2028 1696 wscript.exe 28 PID 1696 wrote to memory of 2028 1696 wscript.exe 28 PID 2028 wrote to memory of 1592 2028 wscript.exe 30 PID 2028 wrote to memory of 1592 2028 wscript.exe 30 PID 2028 wrote to memory of 1592 2028 wscript.exe 30
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Swift Payment PENPO-0409SSI-032022.js"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\IhMiqhRopX.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:544
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Swift Payment PENPO-0409SSI-032022.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\IhMiqhRopX.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:1592
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\IhMiqhRopX.js
- Size 8KB
- SHA256 6b679f895c3f144b34609ae12be76fe82f4cf75efdf5ac2f0eefa7f20beee5cd
- MD5 d8d9ebeb0bf37c7de930d0d19ce7deb9
- SHA1 1ae3da5ac4707ccb056a50b4f76c4202da02bbfa
- SHA512 33fb96c9f814e2d0f0ce018ade0d3a81224296efd8926ee72a4b4142517b73d4a913183ec70d25fb9b3f4c04d1000f5d4978e9b43529c3b37ccb2fe54befea60
- SSDEEP 192:ynUCEt4J+clBZC8mGwBVzVWbgV6qRkMHB5GSvIxoGK3r4tNG:8U+IYZCTBVzV2gVrkMHbGSLtctNG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\IhMiqhRopX.js
- Size 8KB
- SHA256 6b679f895c3f144b34609ae12be76fe82f4cf75efdf5ac2f0eefa7f20beee5cd
- MD5 d8d9ebeb0bf37c7de930d0d19ce7deb9
- SHA1 1ae3da5ac4707ccb056a50b4f76c4202da02bbfa
- SHA512 33fb96c9f814e2d0f0ce018ade0d3a81224296efd8926ee72a4b4142517b73d4a913183ec70d25fb9b3f4c04d1000f5d4978e9b43529c3b37ccb2fe54befea60
- SSDEEP 192:ynUCEt4J+clBZC8mGwBVzVWbgV6qRkMHB5GSvIxoGK3r4tNG:8U+IYZCTBVzV2gVrkMHbGSLtctNG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IhMiqhRopX.js
- Size 8KB
- SHA256 6b679f895c3f144b34609ae12be76fe82f4cf75efdf5ac2f0eefa7f20beee5cd
- MD5 d8d9ebeb0bf37c7de930d0d19ce7deb9
- SHA1 1ae3da5ac4707ccb056a50b4f76c4202da02bbfa
- SHA512 33fb96c9f814e2d0f0ce018ade0d3a81224296efd8926ee72a4b4142517b73d4a913183ec70d25fb9b3f4c04d1000f5d4978e9b43529c3b37ccb2fe54befea60
- SSDEEP 192:ynUCEt4J+clBZC8mGwBVzVWbgV6qRkMHB5GSvIxoGK3r4tNG:8U+IYZCTBVzV2gVrkMHbGSLtctNG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Swift Payment PENPO-0409SSI-032022.js
- Size 47KB
- SHA256 45c4cd068d5217d463f4f60ad7bebeb774943a89e86fa6b9b9da549351aea27d
- MD5 da29c4d1c35bd269018588612eeec23f
- SHA1 7b6f0f2bb0c3accc9a57ce5a550b50294d840e8a
- SHA512 8bdd018a72da202530e405c4a85e65105800deef216552c40dbc9aa12cac7e031a0a06a2f0d43f26ed5a6395e211c678f86d3b889a86e9b5b8bf8e6dc8408147
- SSDEEP 768:MW2cSmgnFw1qRNU5ab7/8MgPmdjVhL+DIpvbekXAmICm28ibK39BraLEfw5ErcBd:MW2bHnSM3U5o8FPmdjVhL+DIpvKkXAxk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Swift Payment PENPO-0409SSI-032022.js
- Size 47KB
- SHA256 45c4cd068d5217d463f4f60ad7bebeb774943a89e86fa6b9b9da549351aea27d
- MD5 da29c4d1c35bd269018588612eeec23f
- SHA1 7b6f0f2bb0c3accc9a57ce5a550b50294d840e8a
- SHA512 8bdd018a72da202530e405c4a85e65105800deef216552c40dbc9aa12cac7e031a0a06a2f0d43f26ed5a6395e211c678f86d3b889a86e9b5b8bf8e6dc8408147
- SSDEEP 768:MW2cSmgnFw1qRNU5ab7/8MgPmdjVhL+DIpvbekXAmICm28ibK39BraLEfw5ErcBd:MW2bHnSM3U5o8FPmdjVhL+DIpvKkXAxk
- MD5 SHA1 SHA512 SSDEEP