Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
30/09/2022, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
Payment-Swift 30-09-2022.js
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Payment-Swift 30-09-2022.js
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target Payment-Swift 30-09-2022.js
- Size 46KB
- Sample220930-mpymmsdcg4
- SHA256 0ec1a20ddac1dfae8aa8d748e9ca674014ef6f3a12eb643c1260071b727c0ee6
- MD5 9992b1e4af3fdd6c7cc6acbc687a3e90
- SHA1 dd6f7e3293ede9d1a826fe56b23d1bf37799fae1
- SHA512 2d0f2fbce674cb26a17c417e5dc8d3de09dbd95f2f29e842a2478bbaaa1d234ae484d11a77aade8ceaa34cc2365e2e4f2c7a52476895fc179edbe24fcb03db98
- SSDEEP 768:5BlM2pDXX8oe77Z6aFoS83vwBaNKTuNbni278K+3ghe0SaYzgBSSLtTG:5Bljp4z774avyIQN8kbni278me0SaqSw
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
wshrat
C2
-
http://jbd231.duckdns.org:2022
Signatures
- Blocklisted process makes network request 36 IoCs
flow pid Process 5 1076 wscript.exe 6 1904 wscript.exe 8 2520 wscript.exe 16 2520 wscript.exe 21 2520 wscript.exe 24 1076 wscript.exe 25 1904 wscript.exe 31 2520 wscript.exe 34 2520 wscript.exe 36 2520 wscript.exe 39 2520 wscript.exe 45 2520 wscript.exe 46 1076 wscript.exe 47 1904 wscript.exe 48 2520 wscript.exe 53 2520 wscript.exe 54 2520 wscript.exe 55 2520 wscript.exe 56 2520 wscript.exe 57 1076 wscript.exe 58 1904 wscript.exe 59 2520 wscript.exe 60 2520 wscript.exe 61 2520 wscript.exe 62 2520 wscript.exe 63 2520 wscript.exe 64 1076 wscript.exe 65 1904 wscript.exe 66 2520 wscript.exe 67 2520 wscript.exe 68 2520 wscript.exe 69 2520 wscript.exe 70 2520 wscript.exe 71 1076 wscript.exe 72 1904 wscript.exe 73 2520 wscript.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation wscript.exe - Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment-Swift 30-09-2022.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cNrOCJfIoI.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment-Swift 30-09-2022.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cNrOCJfIoI.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cNrOCJfIoI.js wscript.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Payment-Swift 30-09-2022 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Payment-Swift 30-09-2022.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Payment-Swift 30-09-2022 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Payment-Swift 30-09-2022.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Payment-Swift 30-09-2022 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Payment-Swift 30-09-2022.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Payment-Swift 30-09-2022 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Payment-Swift 30-09-2022.js\"" wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Script User-Agent 23 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 48 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 54 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 59 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 70 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 8 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 61 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 73 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 56 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 60 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 21 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 31 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 34 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 36 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 45 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 53 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 63 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 66 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 67 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 69 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 39 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 55 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 62 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript HTTP User-Agent header 68 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 30/9/2022|JavaScript - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4664 wrote to memory of 1076 4664 wscript.exe 80 PID 4664 wrote to memory of 1076 4664 wscript.exe 80 PID 4664 wrote to memory of 2520 4664 wscript.exe 81 PID 4664 wrote to memory of 2520 4664 wscript.exe 81 PID 2520 wrote to memory of 1904 2520 wscript.exe 82 PID 2520 wrote to memory of 1904 2520 wscript.exe 82
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Payment-Swift 30-09-2022.js"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\cNrOCJfIoI.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:1076
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Payment-Swift 30-09-2022.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\cNrOCJfIoI.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:1904
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment-Swift 30-09-2022.js
- Size 46KB
- SHA256 0ec1a20ddac1dfae8aa8d748e9ca674014ef6f3a12eb643c1260071b727c0ee6
- MD5 9992b1e4af3fdd6c7cc6acbc687a3e90
- SHA1 dd6f7e3293ede9d1a826fe56b23d1bf37799fae1
- SHA512 2d0f2fbce674cb26a17c417e5dc8d3de09dbd95f2f29e842a2478bbaaa1d234ae484d11a77aade8ceaa34cc2365e2e4f2c7a52476895fc179edbe24fcb03db98
- SSDEEP 768:5BlM2pDXX8oe77Z6aFoS83vwBaNKTuNbni278K+3ghe0SaYzgBSSLtTG:5Bljp4z774avyIQN8kbni278me0SaqSw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cNrOCJfIoI.js
- Size 8KB
- SHA256 6bd50830c98a6505fa3a016c2f1fe8653d62d2c5d9212c0636f9ffb67bce8f27
- MD5 38f775ae3b77cc26ebf7825619155325
- SHA1 515d87a870d9dfa245df48172d63cca22c1410ac
- SHA512 c29417d47acceb725b0ebe4a7bcc13f31ac2483ba478cc7c5c051d59aec3a525d3f62adcff466aa88c6a7b0f87be97135df096689cbb2c9cd3f53b13ce8f5da8
- SSDEEP 192:ynQ1wLe8sJoJCk9WbbqsSRkMHB5GSvIxoGK3u4tNG:8QRLJJbGVkMHbGSLtbtNG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Payment-Swift 30-09-2022.js
- Size 46KB
- SHA256 0ec1a20ddac1dfae8aa8d748e9ca674014ef6f3a12eb643c1260071b727c0ee6
- MD5 9992b1e4af3fdd6c7cc6acbc687a3e90
- SHA1 dd6f7e3293ede9d1a826fe56b23d1bf37799fae1
- SHA512 2d0f2fbce674cb26a17c417e5dc8d3de09dbd95f2f29e842a2478bbaaa1d234ae484d11a77aade8ceaa34cc2365e2e4f2c7a52476895fc179edbe24fcb03db98
- SSDEEP 768:5BlM2pDXX8oe77Z6aFoS83vwBaNKTuNbni278K+3ghe0SaYzgBSSLtTG:5Bljp4z774avyIQN8kbni278me0SaqSw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\cNrOCJfIoI.js
- Size 8KB
- SHA256 6bd50830c98a6505fa3a016c2f1fe8653d62d2c5d9212c0636f9ffb67bce8f27
- MD5 38f775ae3b77cc26ebf7825619155325
- SHA1 515d87a870d9dfa245df48172d63cca22c1410ac
- SHA512 c29417d47acceb725b0ebe4a7bcc13f31ac2483ba478cc7c5c051d59aec3a525d3f62adcff466aa88c6a7b0f87be97135df096689cbb2c9cd3f53b13ce8f5da8
- SSDEEP 192:ynQ1wLe8sJoJCk9WbbqsSRkMHB5GSvIxoGK3u4tNG:8QRLJJbGVkMHbGSLtbtNG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\cNrOCJfIoI.js
- Size 8KB
- SHA256 6bd50830c98a6505fa3a016c2f1fe8653d62d2c5d9212c0636f9ffb67bce8f27
- MD5 38f775ae3b77cc26ebf7825619155325
- SHA1 515d87a870d9dfa245df48172d63cca22c1410ac
- SHA512 c29417d47acceb725b0ebe4a7bcc13f31ac2483ba478cc7c5c051d59aec3a525d3f62adcff466aa88c6a7b0f87be97135df096689cbb2c9cd3f53b13ce8f5da8
- SSDEEP 192:ynQ1wLe8sJoJCk9WbbqsSRkMHB5GSvIxoGK3u4tNG:8QRLJJbGVkMHbGSLtbtNG
- MD5 SHA1 SHA512 SSDEEP