Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
01/10/2022, 07:34
Static task
static1
Behavioral task
behavioral1
Sample
8071f8af591e0433f4709047836143a2.js
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8071f8af591e0433f4709047836143a2.js
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 8071f8af591e0433f4709047836143a2.js
- Size 46KB
- Sample221001-jd4sqsffc5
- SHA256 a69f3622f93337b9501d5721ed248d24f5816a6d57eea3002ce97042e0d0335d
- MD5 8071f8af591e0433f4709047836143a2
- SHA1 9182f3dd3f3b4d1c66f955b87dfde74c50986db1
- SHA512 a3111cc662c335a312dbb9c79172c109da9369e9959c19fbf749c64d5402720036a25da43ceff6bbcbbfdeecbc7ee66c2630e1608b88bb38d7d3a47739035bf7
- SSDEEP 768:EBZf2fDUXKoJY7k8+wryZS83azUz7OCEv1UxKAFyP1KPqVJhajDudIBSSLtQG:EBZufP6Y7kjwrXyUUzyCEv1Ux5yP1KPv
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
wshrat
C2
-
http://fresh01.ddns.net:2256
Signatures
- Blocklisted process makes network request 40 IoCs
flow pid Process 7 4796 wscript.exe 8 1036 wscript.exe 11 4436 wscript.exe 18 4436 wscript.exe 24 4436 wscript.exe 26 4436 wscript.exe 27 4436 wscript.exe 30 4796 wscript.exe 31 1036 wscript.exe 32 4436 wscript.exe 40 4436 wscript.exe 41 4436 wscript.exe 42 4436 wscript.exe 43 4436 wscript.exe 46 4436 wscript.exe 47 4796 wscript.exe 48 1036 wscript.exe 50 4436 wscript.exe 51 4436 wscript.exe 52 4436 wscript.exe 53 4436 wscript.exe 54 4436 wscript.exe 55 4796 wscript.exe 56 1036 wscript.exe 57 4436 wscript.exe 58 4436 wscript.exe 59 4436 wscript.exe 60 4436 wscript.exe 61 4436 wscript.exe 62 4796 wscript.exe 63 1036 wscript.exe 64 4436 wscript.exe 65 4436 wscript.exe 66 4436 wscript.exe 67 4436 wscript.exe 68 4436 wscript.exe 69 4796 wscript.exe 70 1036 wscript.exe 71 4436 wscript.exe 72 4436 wscript.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wscript.exe - Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LYSVcAPajL.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8071f8af591e0433f4709047836143a2.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LYSVcAPajL.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8071f8af591e0433f4709047836143a2.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LYSVcAPajL.js wscript.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8071f8af591e0433f4709047836143a2 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\8071f8af591e0433f4709047836143a2.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8071f8af591e0433f4709047836143a2 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\8071f8af591e0433f4709047836143a2.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8071f8af591e0433f4709047836143a2 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\8071f8af591e0433f4709047836143a2.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8071f8af591e0433f4709047836143a2 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\8071f8af591e0433f4709047836143a2.js\"" wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Script User-Agent 28 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 24 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 54 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 32 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 40 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 41 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 60 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 65 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 57 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 59 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 64 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 26 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 27 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 51 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 58 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 72 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 53 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 71 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 11 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 42 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 43 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 61 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 66 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 68 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 18 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 46 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 50 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 52 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript HTTP User-Agent header 67 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/10/2022|JavaScript - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3204 wrote to memory of 4796 3204 wscript.exe 82 PID 3204 wrote to memory of 4796 3204 wscript.exe 82 PID 3204 wrote to memory of 4436 3204 wscript.exe 83 PID 3204 wrote to memory of 4436 3204 wscript.exe 83 PID 4436 wrote to memory of 1036 4436 wscript.exe 84 PID 4436 wrote to memory of 1036 4436 wscript.exe 84
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\8071f8af591e0433f4709047836143a2.js1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\LYSVcAPajL.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:4796
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\8071f8af591e0433f4709047836143a2.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\LYSVcAPajL.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:1036
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\8071f8af591e0433f4709047836143a2.js
- Size 46KB
- SHA256 a69f3622f93337b9501d5721ed248d24f5816a6d57eea3002ce97042e0d0335d
- MD5 8071f8af591e0433f4709047836143a2
- SHA1 9182f3dd3f3b4d1c66f955b87dfde74c50986db1
- SHA512 a3111cc662c335a312dbb9c79172c109da9369e9959c19fbf749c64d5402720036a25da43ceff6bbcbbfdeecbc7ee66c2630e1608b88bb38d7d3a47739035bf7
- SSDEEP 768:EBZf2fDUXKoJY7k8+wryZS83azUz7OCEv1UxKAFyP1KPqVJhajDudIBSSLtQG:EBZufP6Y7kjwrXyUUzyCEv1Ux5yP1KPv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LYSVcAPajL.js
- Size 8KB
- SHA256 f81d458fa6805fba10b88e95c8e719d6e81d0c40912b423a3172054224486f29
- MD5 14d42b78dfc0881ad108312805fd5455
- SHA1 9fa789943a0d8d06c85373e18721cf97a69be5db
- SHA512 91146453b2d2debc16c3ec9b9bc1acd05fb3f4752f26c5b9effafe854ebf14ca81ef57cf29cba4ee624939f747132f1833d006c01b6d3e081c6f4241685b68e1
- SSDEEP 192:yn3y4LTsLJo18PO5MOUsERkMHB5GSvIxoGK3v4tNG:83HcJh0Mn/kMHbGSLtQtNG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LYSVcAPajL.js
- Size 8KB
- SHA256 f81d458fa6805fba10b88e95c8e719d6e81d0c40912b423a3172054224486f29
- MD5 14d42b78dfc0881ad108312805fd5455
- SHA1 9fa789943a0d8d06c85373e18721cf97a69be5db
- SHA512 91146453b2d2debc16c3ec9b9bc1acd05fb3f4752f26c5b9effafe854ebf14ca81ef57cf29cba4ee624939f747132f1833d006c01b6d3e081c6f4241685b68e1
- SSDEEP 192:yn3y4LTsLJo18PO5MOUsERkMHB5GSvIxoGK3v4tNG:83HcJh0Mn/kMHbGSLtQtNG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8071f8af591e0433f4709047836143a2.js
- Size 46KB
- SHA256 a69f3622f93337b9501d5721ed248d24f5816a6d57eea3002ce97042e0d0335d
- MD5 8071f8af591e0433f4709047836143a2
- SHA1 9182f3dd3f3b4d1c66f955b87dfde74c50986db1
- SHA512 a3111cc662c335a312dbb9c79172c109da9369e9959c19fbf749c64d5402720036a25da43ceff6bbcbbfdeecbc7ee66c2630e1608b88bb38d7d3a47739035bf7
- SSDEEP 768:EBZf2fDUXKoJY7k8+wryZS83azUz7OCEv1UxKAFyP1KPqVJhajDudIBSSLtQG:EBZufP6Y7kjwrXyUUzyCEv1Ux5yP1KPv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LYSVcAPajL.js
- Size 8KB
- SHA256 f81d458fa6805fba10b88e95c8e719d6e81d0c40912b423a3172054224486f29
- MD5 14d42b78dfc0881ad108312805fd5455
- SHA1 9fa789943a0d8d06c85373e18721cf97a69be5db
- SHA512 91146453b2d2debc16c3ec9b9bc1acd05fb3f4752f26c5b9effafe854ebf14ca81ef57cf29cba4ee624939f747132f1833d006c01b6d3e081c6f4241685b68e1
- SSDEEP 192:yn3y4LTsLJo18PO5MOUsERkMHB5GSvIxoGK3v4tNG:83HcJh0Mn/kMHbGSLtQtNG
- MD5 SHA1 SHA512 SSDEEP