Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-11-2022 08:40
Static task
static1
Behavioral task
behavioral1
Sample
wynmove (1).js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
wynmove (1).js
Resource
win10v2004-20220901-en
General
-
Target
wynmove (1).js
-
Size
24KB
-
MD5
dc1bb14d9ae229088128fc7b820e0b37
-
SHA1
6852c416ec186e6cdd3be3e4bc13a2ec94dc1b0b
-
SHA256
03b7620c65c87c6db1bc76f63d8e88799bcd920b90e91f6bbbe8e4a899080270
-
SHA512
5192f50e7b013d09742e4e515f910933b5e8aabd80313a689cd3b89e757da7a49cd6acf2e315d5ea68eb67f263ffe76a32bbce2458a9d031fa51a8d1febd171b
-
SSDEEP
768:15nGPVNjCjZdGOO70IXgD2KTinmtalzDcVgg8a:1ZeKR
Malware Config
Extracted
wshrat
http://45.139.105.174:7670
Signatures
-
Blocklisted process makes network request 26 IoCs
flow pid Process 3 1528 wscript.exe 4 1528 wscript.exe 5 1528 wscript.exe 7 1528 wscript.exe 8 1528 wscript.exe 9 1528 wscript.exe 12 1528 wscript.exe 13 1528 wscript.exe 14 1528 wscript.exe 16 1528 wscript.exe 17 1528 wscript.exe 18 1528 wscript.exe 20 1528 wscript.exe 21 1528 wscript.exe 22 1528 wscript.exe 24 1528 wscript.exe 25 1528 wscript.exe 26 1528 wscript.exe 28 1528 wscript.exe 29 1528 wscript.exe 30 1528 wscript.exe 32 1528 wscript.exe 33 1528 wscript.exe 34 1528 wscript.exe 36 1528 wscript.exe 37 1528 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wynmove (1).js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wynmove (1).js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wynmove (1) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\wynmove (1).js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\wynmove (1) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\wynmove (1).js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wynmove (1) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\wynmove (1).js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\wynmove (1) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\wynmove (1).js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 26 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 7 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 13 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 18 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 24 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 29 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 36 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 37 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 3 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 8 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 9 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 12 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 22 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 30 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 17 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 28 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 33 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 26 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 4 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 5 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 14 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 16 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 20 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 21 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 25 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 32 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 34 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 856 wrote to memory of 1528 856 wscript.exe 26 PID 856 wrote to memory of 1528 856 wscript.exe 26 PID 856 wrote to memory of 1528 856 wscript.exe 26
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\wynmove (1).js"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\wynmove (1).js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1528
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5dc1bb14d9ae229088128fc7b820e0b37
SHA16852c416ec186e6cdd3be3e4bc13a2ec94dc1b0b
SHA25603b7620c65c87c6db1bc76f63d8e88799bcd920b90e91f6bbbe8e4a899080270
SHA5125192f50e7b013d09742e4e515f910933b5e8aabd80313a689cd3b89e757da7a49cd6acf2e315d5ea68eb67f263ffe76a32bbce2458a9d031fa51a8d1febd171b
-
Filesize
24KB
MD5dc1bb14d9ae229088128fc7b820e0b37
SHA16852c416ec186e6cdd3be3e4bc13a2ec94dc1b0b
SHA25603b7620c65c87c6db1bc76f63d8e88799bcd920b90e91f6bbbe8e4a899080270
SHA5125192f50e7b013d09742e4e515f910933b5e8aabd80313a689cd3b89e757da7a49cd6acf2e315d5ea68eb67f263ffe76a32bbce2458a9d031fa51a8d1febd171b