Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2022 13:33
Static task
static1
Behavioral task
behavioral1
Sample
PO CF004303.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PO CF004303.js
Resource
win10v2004-20220812-en
General
-
Target
PO CF004303.js
-
Size
52KB
-
MD5
4a70919d125ea1c01065710550d3cf6a
-
SHA1
03c636a5603d3781f25248ed761316af876f0538
-
SHA256
87c02c61d4cf74ebabc28dab3d1f91593a87eebd31f97d0913967bf975f6d62b
-
SHA512
28d5d3dc078c317eb21c7685a8d6b00c86ea5970651a675e158db5e28f4ddb7f7a4a6979d7cb32ca3c29a430b28276195f9213a3852f51cba5a639301b2afdb3
-
SSDEEP
768:pMgbzZ2OkxKvwNi/3HgFBgzZhnooQT1DLsjg7EjDBNSamcnZMqX3LaWJIo/K:jsKdA3gzw31DygKSamQjnWWl/K
Malware Config
Extracted
wshrat
http://37.0.14.195:1604
Signatures
-
Blocklisted process makes network request 41 IoCs
flow pid Process 5 3620 wscript.exe 7 1948 wscript.exe 8 4916 wscript.exe 17 3620 wscript.exe 18 3620 wscript.exe 19 3620 wscript.exe 22 3620 wscript.exe 24 3620 wscript.exe 31 4916 wscript.exe 32 1948 wscript.exe 36 3620 wscript.exe 42 3620 wscript.exe 43 3620 wscript.exe 44 3620 wscript.exe 47 3620 wscript.exe 48 3620 wscript.exe 49 1948 wscript.exe 50 4916 wscript.exe 53 3620 wscript.exe 55 3620 wscript.exe 56 3620 wscript.exe 57 3620 wscript.exe 58 3620 wscript.exe 59 1948 wscript.exe 60 4916 wscript.exe 61 3620 wscript.exe 63 3620 wscript.exe 64 3620 wscript.exe 65 3620 wscript.exe 66 3620 wscript.exe 67 3620 wscript.exe 68 1948 wscript.exe 69 4916 wscript.exe 70 3620 wscript.exe 71 3620 wscript.exe 72 3620 wscript.exe 73 3620 wscript.exe 74 3620 wscript.exe 75 1948 wscript.exe 76 4916 wscript.exe 77 3620 wscript.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO CF004303.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO CF004303.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YYELvrJUmX.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YYELvrJUmX.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YYELvrJUmX.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO CF004303.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO CF004303.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO CF004303.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO CF004303.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\software\microsoft\windows\currentversion\run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 29 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 19 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 47 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 71 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 48 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 53 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 57 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 63 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 70 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 5 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 17 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 61 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 73 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 18 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 22 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 44 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 55 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 65 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 24 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 43 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 58 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 66 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 67 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 72 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 74 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 36 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 64 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 42 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 56 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript HTTP User-Agent header 77 WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1556 wrote to memory of 4916 1556 wscript.exe 81 PID 1556 wrote to memory of 4916 1556 wscript.exe 81 PID 1556 wrote to memory of 3620 1556 wscript.exe 82 PID 1556 wrote to memory of 3620 1556 wscript.exe 82 PID 3620 wrote to memory of 1948 3620 wscript.exe 84 PID 3620 wrote to memory of 1948 3620 wscript.exe 84
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\PO CF004303.js"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\YYELvrJUmX.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:4916
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PO CF004303.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\YYELvrJUmX.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:1948
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD54a70919d125ea1c01065710550d3cf6a
SHA103c636a5603d3781f25248ed761316af876f0538
SHA25687c02c61d4cf74ebabc28dab3d1f91593a87eebd31f97d0913967bf975f6d62b
SHA51228d5d3dc078c317eb21c7685a8d6b00c86ea5970651a675e158db5e28f4ddb7f7a4a6979d7cb32ca3c29a430b28276195f9213a3852f51cba5a639301b2afdb3
-
Filesize
52KB
MD54a70919d125ea1c01065710550d3cf6a
SHA103c636a5603d3781f25248ed761316af876f0538
SHA25687c02c61d4cf74ebabc28dab3d1f91593a87eebd31f97d0913967bf975f6d62b
SHA51228d5d3dc078c317eb21c7685a8d6b00c86ea5970651a675e158db5e28f4ddb7f7a4a6979d7cb32ca3c29a430b28276195f9213a3852f51cba5a639301b2afdb3
-
Filesize
10KB
MD58347dbb77c8799b4c7cad9928702f1d7
SHA1e87231a42abb961ec0ef459ddee48331a90275d5
SHA25687d9d47c5591a8d90f1fd3ebc421135dfad6ef97a7b454fb7d034b0f948964df
SHA512a0ebdeb58a5446fc3696090f69043be6244af6cdada71d77380120e9f23ce4bafae2e105f1df6c0d502f419a5718d3498a9329e417c27e109c85ba04c4adc19f
-
Filesize
10KB
MD58347dbb77c8799b4c7cad9928702f1d7
SHA1e87231a42abb961ec0ef459ddee48331a90275d5
SHA25687d9d47c5591a8d90f1fd3ebc421135dfad6ef97a7b454fb7d034b0f948964df
SHA512a0ebdeb58a5446fc3696090f69043be6244af6cdada71d77380120e9f23ce4bafae2e105f1df6c0d502f419a5718d3498a9329e417c27e109c85ba04c4adc19f