Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
27/10/2022, 05:51
Static task
static1
Behavioral task
behavioral1
Sample
Goods.js
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Goods.js
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target Goods.js
- Size 25KB
- Sample221027-gj57msbaf2
- SHA256 a4aa874fca6b92a1230f369b0b6669bf002b6c57b46266c0f4c7b6e0c195bcbb
- MD5 f1adae8851371ac2265761f593c99b7f
- SHA1 fd0258eba70d536c198650fbe24ff9c01d5c472a
- SHA512 d6d375257553fe57fe9785ff243d7a188dba63a687422d189ba5ce2c6aceab3b89d206566ba9a5afc77729d0d57c043cfc1bf69a9a44609d6197542f090c372a
- SSDEEP 384:wPUtaScSEbyO+0Wrr6k5AFv0KoYDBRmGgp1i394eeS3:QC7EbGruFveYDBRmGguN4e13
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
wshrat
C2
-
http://212.193.30.230:7780
Signatures
- Blocklisted process makes network request 30 IoCs
flow pid Process 5 2620 wscript.exe 12 2620 wscript.exe 14 2620 wscript.exe 15 2620 wscript.exe 16 2620 wscript.exe 18 2620 wscript.exe 28 2620 wscript.exe 33 2620 wscript.exe 34 2620 wscript.exe 35 2620 wscript.exe 38 2620 wscript.exe 39 2620 wscript.exe 42 2620 wscript.exe 43 2620 wscript.exe 44 2620 wscript.exe 45 2620 wscript.exe 46 2620 wscript.exe 47 2620 wscript.exe 49 2620 wscript.exe 50 2620 wscript.exe 51 2620 wscript.exe 52 2620 wscript.exe 53 2620 wscript.exe 54 2620 wscript.exe 55 2620 wscript.exe 56 2620 wscript.exe 57 2620 wscript.exe 58 2620 wscript.exe 59 2620 wscript.exe 60 2620 wscript.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wscript.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Goods.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Goods.js wscript.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Goods = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Goods.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Goods = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Goods.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Goods = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Goods.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Goods = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Goods.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Script User-Agent 30 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 56 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 15 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 18 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 35 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 42 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 55 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 52 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 59 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 12 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 28 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 38 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 39 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 43 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 5 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 34 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 50 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 58 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 44 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 46 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 53 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 54 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 33 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 60 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 14 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 16 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 47 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 49 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 57 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 45 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 51 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4920 wrote to memory of 2620 4920 wscript.exe 82 PID 4920 wrote to memory of 2620 4920 wscript.exe 82
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Goods.js1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Goods.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2620
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Goods.js
- Size 25KB
- SHA256 a4aa874fca6b92a1230f369b0b6669bf002b6c57b46266c0f4c7b6e0c195bcbb
- MD5 f1adae8851371ac2265761f593c99b7f
- SHA1 fd0258eba70d536c198650fbe24ff9c01d5c472a
- SHA512 d6d375257553fe57fe9785ff243d7a188dba63a687422d189ba5ce2c6aceab3b89d206566ba9a5afc77729d0d57c043cfc1bf69a9a44609d6197542f090c372a
- SSDEEP 384:wPUtaScSEbyO+0Wrr6k5AFv0KoYDBRmGgp1i394eeS3:QC7EbGruFveYDBRmGguN4e13
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Goods.js
- Size 25KB
- SHA256 a4aa874fca6b92a1230f369b0b6669bf002b6c57b46266c0f4c7b6e0c195bcbb
- MD5 f1adae8851371ac2265761f593c99b7f
- SHA1 fd0258eba70d536c198650fbe24ff9c01d5c472a
- SHA512 d6d375257553fe57fe9785ff243d7a188dba63a687422d189ba5ce2c6aceab3b89d206566ba9a5afc77729d0d57c043cfc1bf69a9a44609d6197542f090c372a
- SSDEEP 384:wPUtaScSEbyO+0Wrr6k5AFv0KoYDBRmGgp1i394eeS3:QC7EbGruFveYDBRmGguN4e13
- MD5 SHA1 SHA512 SSDEEP