Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-11-2022 12:56
Static task
static1
Behavioral task
behavioral1
Sample
PO N°CF004303.js
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PO N°CF004303.js
Resource
win10v2004-20220812-en
General
-
Target
PO N°CF004303.js
-
Size
52KB
-
MD5
587ad35d06bccec7b8ff387dc0e5797e
-
SHA1
f8729b7d69e638887de8de9afd49f134b8c58025
-
SHA256
63def6511d6202684199b8135f9294a1ed0842f30cdb9788a6e6af08ded2bf0b
-
SHA512
9d71e0eda2492f26bbabab0344b9ab8ad9f11955d8b6a0a9ae4cb0486055ceb83afdcd95747c9739c56477b9346366ccc3e8f1f2a63f101a1c75d4d631cdb96c
-
SSDEEP
1536:Ol/31MQwrtOdTFUErwEXQZvrLmhg36pnGAZE+AK:OGErw+l
Malware Config
Extracted
wshrat
http://194.5.98.198:1604
Signatures
-
Blocklisted process makes network request 37 IoCs
flow pid Process 9 568 wscript.exe 10 980 wscript.exe 11 656 wscript.exe 13 656 wscript.exe 14 656 wscript.exe 16 656 wscript.exe 19 656 wscript.exe 21 656 wscript.exe 24 980 wscript.exe 25 568 wscript.exe 27 656 wscript.exe 30 656 wscript.exe 33 656 wscript.exe 36 656 wscript.exe 38 656 wscript.exe 40 656 wscript.exe 43 980 wscript.exe 44 568 wscript.exe 46 656 wscript.exe 48 656 wscript.exe 50 656 wscript.exe 53 656 wscript.exe 59 656 wscript.exe 60 980 wscript.exe 61 568 wscript.exe 64 656 wscript.exe 67 656 wscript.exe 68 656 wscript.exe 70 656 wscript.exe 74 656 wscript.exe 76 656 wscript.exe 79 568 wscript.exe 80 980 wscript.exe 82 656 wscript.exe 84 656 wscript.exe 86 656 wscript.exe 89 656 wscript.exe -
Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO N°CF004303.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xaRVcbREmE.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xaRVcbREmE.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xaRVcbREmE.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO N°CF004303.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO N°CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO N°CF004303.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO N°CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO N°CF004303.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO N°CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO N°CF004303.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO N°CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO N°CF004303.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 27 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 53 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 27 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 40 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 33 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 46 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 30 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 84 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 68 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 82 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 21 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 36 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 38 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 76 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 86 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 11 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 64 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 89 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 48 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 59 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 67 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 70 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 19 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 50 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 13 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 16 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 74 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript HTTP User-Agent header 14 WSHRAT|94A7BB46|RYNKSFQE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/11/2022|JavaScript -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1056 wrote to memory of 980 1056 wscript.exe 26 PID 1056 wrote to memory of 980 1056 wscript.exe 26 PID 1056 wrote to memory of 980 1056 wscript.exe 26 PID 1056 wrote to memory of 656 1056 wscript.exe 27 PID 1056 wrote to memory of 656 1056 wscript.exe 27 PID 1056 wrote to memory of 656 1056 wscript.exe 27 PID 656 wrote to memory of 568 656 wscript.exe 29 PID 656 wrote to memory of 568 656 wscript.exe 29 PID 656 wrote to memory of 568 656 wscript.exe 29
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\PO N°CF004303.js"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xaRVcbREmE.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:980
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PO N°CF004303.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xaRVcbREmE.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:568
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5587ad35d06bccec7b8ff387dc0e5797e
SHA1f8729b7d69e638887de8de9afd49f134b8c58025
SHA25663def6511d6202684199b8135f9294a1ed0842f30cdb9788a6e6af08ded2bf0b
SHA5129d71e0eda2492f26bbabab0344b9ab8ad9f11955d8b6a0a9ae4cb0486055ceb83afdcd95747c9739c56477b9346366ccc3e8f1f2a63f101a1c75d4d631cdb96c
-
Filesize
10KB
MD5f9332f9e18de0d77598ea6b6ca069da2
SHA109f7ba47ca4f682f500b2aa262326d7f60ef1cfa
SHA256c0f0acfd56e2319b12d4a903e3fa99dce5d9afe751cfb13c939615b4fa92bb99
SHA51276bdb8a2a519c788f4d2248474e8b68d96eba76e3609d1c7e87f0bed684231d66e01868ea358fe02634b2feac147655e20274adef4920dee07d199d7e1e82aac
-
Filesize
52KB
MD5587ad35d06bccec7b8ff387dc0e5797e
SHA1f8729b7d69e638887de8de9afd49f134b8c58025
SHA25663def6511d6202684199b8135f9294a1ed0842f30cdb9788a6e6af08ded2bf0b
SHA5129d71e0eda2492f26bbabab0344b9ab8ad9f11955d8b6a0a9ae4cb0486055ceb83afdcd95747c9739c56477b9346366ccc3e8f1f2a63f101a1c75d4d631cdb96c
-
Filesize
10KB
MD5f9332f9e18de0d77598ea6b6ca069da2
SHA109f7ba47ca4f682f500b2aa262326d7f60ef1cfa
SHA256c0f0acfd56e2319b12d4a903e3fa99dce5d9afe751cfb13c939615b4fa92bb99
SHA51276bdb8a2a519c788f4d2248474e8b68d96eba76e3609d1c7e87f0bed684231d66e01868ea358fe02634b2feac147655e20274adef4920dee07d199d7e1e82aac
-
Filesize
10KB
MD5f9332f9e18de0d77598ea6b6ca069da2
SHA109f7ba47ca4f682f500b2aa262326d7f60ef1cfa
SHA256c0f0acfd56e2319b12d4a903e3fa99dce5d9afe751cfb13c939615b4fa92bb99
SHA51276bdb8a2a519c788f4d2248474e8b68d96eba76e3609d1c7e87f0bed684231d66e01868ea358fe02634b2feac147655e20274adef4920dee07d199d7e1e82aac