Analysis
- max time kernel
145s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
27/10/2022, 08:56
Static task
static1
Behavioral task
behavioral1
Sample
wynmove (1).js
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
wynmove (1).js
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target wynmove (1).js
- Size 25KB
- Sample221027-kv1m3sbfb8
- SHA256 7c99d386a0f2df0ef6bc6adc32207bec986ec5784e102081441c2299487af118
- MD5 dc29c0a43eee53c7d2ac1467c6bacc95
- SHA1 d7ddf05456e62c9f67fea236f4fc095693fe6bb2
- SHA512 a4b518116b0b8cc5efa369423ec7a1cc6948e40f1cc2e0d184189d6ed4f581aca2b4ef9d3bbc7f08da614a087a377a11fa3f11759dbb561da6bfc9ef9fc827f7
- SSDEEP 384:2LZdyzGc+R5+MM+PqsZHdGD9wC19p4FrIFn8g2KgMOJNpaxv5psFxe:2DFhKMzqaelp4FrIF8gG0sPe
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
wshrat
C2
-
http://45.139.105.174:7670
Signatures
- Blocklisted process makes network request 25 IoCs
flow pid Process 5 4476 wscript.exe 11 4476 wscript.exe 14 4476 wscript.exe 19 4476 wscript.exe 20 4476 wscript.exe 22 4476 wscript.exe 31 4476 wscript.exe 32 4476 wscript.exe 34 4476 wscript.exe 35 4476 wscript.exe 38 4476 wscript.exe 39 4476 wscript.exe 41 4476 wscript.exe 42 4476 wscript.exe 43 4476 wscript.exe 44 4476 wscript.exe 45 4476 wscript.exe 46 4476 wscript.exe 48 4476 wscript.exe 49 4476 wscript.exe 50 4476 wscript.exe 51 4476 wscript.exe 52 4476 wscript.exe 53 4476 wscript.exe 54 4476 wscript.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation wscript.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wynmove (1).js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wynmove (1).js wscript.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wynmove (1) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\wynmove (1).js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wynmove (1) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\wynmove (1).js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wynmove (1) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\wynmove (1).js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wynmove (1) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\wynmove (1).js\"" wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Script User-Agent 24 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 51 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 5 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 32 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 45 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 34 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 38 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 39 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 42 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 43 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 11 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 19 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 22 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 44 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 46 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 50 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 53 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 31 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 35 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 52 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 48 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 54 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 14 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 20 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript HTTP User-Agent header 41 WSHRAT|18024990|TMKNGOMU|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/10/2022|JavaScript - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1152 wrote to memory of 4476 1152 wscript.exe 79 PID 1152 wrote to memory of 4476 1152 wscript.exe 79
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\wynmove (1).js"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\wynmove (1).js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4476
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wynmove (1).js
- Size 25KB
- SHA256 7c99d386a0f2df0ef6bc6adc32207bec986ec5784e102081441c2299487af118
- MD5 dc29c0a43eee53c7d2ac1467c6bacc95
- SHA1 d7ddf05456e62c9f67fea236f4fc095693fe6bb2
- SHA512 a4b518116b0b8cc5efa369423ec7a1cc6948e40f1cc2e0d184189d6ed4f581aca2b4ef9d3bbc7f08da614a087a377a11fa3f11759dbb561da6bfc9ef9fc827f7
- SSDEEP 384:2LZdyzGc+R5+MM+PqsZHdGD9wC19p4FrIFn8g2KgMOJNpaxv5psFxe:2DFhKMzqaelp4FrIF8gG0sPe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\wynmove (1).js
- Size 25KB
- SHA256 7c99d386a0f2df0ef6bc6adc32207bec986ec5784e102081441c2299487af118
- MD5 dc29c0a43eee53c7d2ac1467c6bacc95
- SHA1 d7ddf05456e62c9f67fea236f4fc095693fe6bb2
- SHA512 a4b518116b0b8cc5efa369423ec7a1cc6948e40f1cc2e0d184189d6ed4f581aca2b4ef9d3bbc7f08da614a087a377a11fa3f11759dbb561da6bfc9ef9fc827f7
- SSDEEP 384:2LZdyzGc+R5+MM+PqsZHdGD9wC19p4FrIFn8g2KgMOJNpaxv5psFxe:2DFhKMzqaelp4FrIF8gG0sPe
- MD5 SHA1 SHA512 SSDEEP