Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-11-2022 06:42
Static task
static1
Behavioral task
behavioral1
Sample
PO.js
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PO.js
Resource
win10v2004-20220812-en
General
-
Target
PO.js
-
Size
24KB
-
MD5
963ca126766bbcd9e8384b9ef2c74673
-
SHA1
59ac9982bde3dcf4d4a89e99b8ab08fedce02ba5
-
SHA256
7549db05702b59ca48c9faaab687273bbe8abad0c8d27540ca89f63ed3c9ed5a
-
SHA512
0df472aa3d72ab2cb7269eb55c3b4a05a3b654a280ccec9f5bd10f6dca07d98ea9c3cb0be101fa5ad973fa718e16c0605ac4a4d8e94952b18140f4c9394d2480
-
SSDEEP
384:Aq0a8IOmVLZAQOksb6frbfRHdBtvhaI4JX1w6nofZMCaZQzun4Gg6O3JoYiXP3sw:ANIOU7smvgISofbNOaJEvcQF
Malware Config
Extracted
wshrat
http://212.193.30.230:7780
Signatures
-
Blocklisted process makes network request 27 IoCs
flow pid Process 3 1760 wscript.exe 4 1760 wscript.exe 5 1760 wscript.exe 7 1760 wscript.exe 8 1760 wscript.exe 9 1760 wscript.exe 11 1760 wscript.exe 13 1760 wscript.exe 14 1760 wscript.exe 16 1760 wscript.exe 17 1760 wscript.exe 18 1760 wscript.exe 20 1760 wscript.exe 21 1760 wscript.exe 22 1760 wscript.exe 24 1760 wscript.exe 25 1760 wscript.exe 26 1760 wscript.exe 27 1760 wscript.exe 29 1760 wscript.exe 30 1760 wscript.exe 31 1760 wscript.exe 33 1760 wscript.exe 34 1760 wscript.exe 35 1760 wscript.exe 37 1760 wscript.exe 38 1760 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 25 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 8 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 29 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 7 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 9 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 16 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 17 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 20 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 21 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 3 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 4 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 25 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 31 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 22 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 24 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 13 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 14 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 33 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 34 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 5 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 11 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 35 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 37 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 38 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 18 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 30 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1760 2028 wscript.exe 27 PID 2028 wrote to memory of 1760 2028 wscript.exe 27 PID 2028 wrote to memory of 1760 2028 wscript.exe 27
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PO.js1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PO.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1760
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5963ca126766bbcd9e8384b9ef2c74673
SHA159ac9982bde3dcf4d4a89e99b8ab08fedce02ba5
SHA2567549db05702b59ca48c9faaab687273bbe8abad0c8d27540ca89f63ed3c9ed5a
SHA5120df472aa3d72ab2cb7269eb55c3b4a05a3b654a280ccec9f5bd10f6dca07d98ea9c3cb0be101fa5ad973fa718e16c0605ac4a4d8e94952b18140f4c9394d2480
-
Filesize
24KB
MD5963ca126766bbcd9e8384b9ef2c74673
SHA159ac9982bde3dcf4d4a89e99b8ab08fedce02ba5
SHA2567549db05702b59ca48c9faaab687273bbe8abad0c8d27540ca89f63ed3c9ed5a
SHA5120df472aa3d72ab2cb7269eb55c3b4a05a3b654a280ccec9f5bd10f6dca07d98ea9c3cb0be101fa5ad973fa718e16c0605ac4a4d8e94952b18140f4c9394d2480