Analysis
- max time kernel
149s - max time network
158s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
09/11/2022, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
Quotation Request.js
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Quotation Request.js
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target Quotation Request.js
- Size 44KB
- Sample221109-rmtywshfa4
- SHA256 ee442f3b315081d57f588d3a260b3f6b53a374113ef6de989250b8a36cc131e2
- MD5 9f09acf3f30f2b09d7509a7eda87a14e
- SHA1 d833eb8a70209454b68df1fcd10c54832298231f
- SHA512 9413f70f28f039d60e5dc0ad7edbcf87aa73e8ab317c45616eb612ebdd80e8f6465992d43b738af9560fbe718221b616de977eac6ee5d6fb4cd65807ae9ffff1
- SSDEEP 768:5UDwr0mf+kAzUOOCqret7eYpcFL3aXiSBQcvYcVPfzXBf0VzUw0Oz+:uYf+FzkhitdmbxSBeEfdMow0OS
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
wshrat
C2
-
http://kmajewska.duckdns.org:2556
Signatures
- Blocklisted process makes network request 33 IoCs
flow pid Process 10 1836 wscript.exe 11 996 wscript.exe 12 1608 wscript.exe 13 1608 wscript.exe 15 1608 wscript.exe 17 1608 wscript.exe 21 1608 wscript.exe 23 1608 wscript.exe 25 996 wscript.exe 28 1836 wscript.exe 29 1608 wscript.exe 31 1608 wscript.exe 33 1608 wscript.exe 37 1608 wscript.exe 39 1608 wscript.exe 41 996 wscript.exe 43 1836 wscript.exe 44 1608 wscript.exe 47 1608 wscript.exe 49 1608 wscript.exe 52 1608 wscript.exe 57 1608 wscript.exe 58 996 wscript.exe 59 1836 wscript.exe 62 1608 wscript.exe 63 1608 wscript.exe 65 1608 wscript.exe 68 1608 wscript.exe 71 1608 wscript.exe 73 996 wscript.exe 75 1836 wscript.exe 76 1608 wscript.exe 78 1608 wscript.exe - Drops startup file 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js wscript.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Script User-Agent 23 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 52 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 62 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 71 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 15 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 33 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 49 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 37 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 63 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 68 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 12 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 29 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 31 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 44 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 47 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 57 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 65 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 76 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 13 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 17 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 23 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 21 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 39 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript HTTP User-Agent header 78 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2044 wrote to memory of 996 2044 wscript.exe 26 PID 2044 wrote to memory of 996 2044 wscript.exe 26 PID 2044 wrote to memory of 996 2044 wscript.exe 26 PID 2044 wrote to memory of 1608 2044 wscript.exe 27 PID 2044 wrote to memory of 1608 2044 wscript.exe 27 PID 2044 wrote to memory of 1608 2044 wscript.exe 27 PID 1608 wrote to memory of 1836 1608 wscript.exe 28 PID 1608 wrote to memory of 1836 1608 wscript.exe 28 PID 1608 wrote to memory of 1836 1608 wscript.exe 28
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Quotation Request.js"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:996
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Quotation Request.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:1836
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js
- Size 44KB
- SHA256 ee442f3b315081d57f588d3a260b3f6b53a374113ef6de989250b8a36cc131e2
- MD5 9f09acf3f30f2b09d7509a7eda87a14e
- SHA1 d833eb8a70209454b68df1fcd10c54832298231f
- SHA512 9413f70f28f039d60e5dc0ad7edbcf87aa73e8ab317c45616eb612ebdd80e8f6465992d43b738af9560fbe718221b616de977eac6ee5d6fb4cd65807ae9ffff1
- SSDEEP 768:5UDwr0mf+kAzUOOCqret7eYpcFL3aXiSBQcvYcVPfzXBf0VzUw0Oz+:uYf+FzkhitdmbxSBeEfdMow0OS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js
- Size 7KB
- SHA256 e48d325c213c149da8dadd739c0e5279b1fadac980ece81346a883fecbabfe6b
- MD5 54a1c2c82989d556e1c1e0403f70f93c
- SHA1 f0f836feb62397bcc95991557738e872d12bed05
- SHA512 035225c2fd4ca0fe8972bd26cdfc2f1580f9bc4826193e3f273f66b0d8675ee24181935a6b0d7dce4fbde2768f4b0f5dea90f151084812edee59609a0adfdba2
- SSDEEP 192:5UpJw/pi3kjwuJYLicwJgGhGpFwKwnKsKQ:5UpJw6k0uRHJXkwKwK8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Quotation Request.js
- Size 44KB
- SHA256 ee442f3b315081d57f588d3a260b3f6b53a374113ef6de989250b8a36cc131e2
- MD5 9f09acf3f30f2b09d7509a7eda87a14e
- SHA1 d833eb8a70209454b68df1fcd10c54832298231f
- SHA512 9413f70f28f039d60e5dc0ad7edbcf87aa73e8ab317c45616eb612ebdd80e8f6465992d43b738af9560fbe718221b616de977eac6ee5d6fb4cd65807ae9ffff1
- SSDEEP 768:5UDwr0mf+kAzUOOCqret7eYpcFL3aXiSBQcvYcVPfzXBf0VzUw0Oz+:uYf+FzkhitdmbxSBeEfdMow0OS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js
- Size 7KB
- SHA256 e48d325c213c149da8dadd739c0e5279b1fadac980ece81346a883fecbabfe6b
- MD5 54a1c2c82989d556e1c1e0403f70f93c
- SHA1 f0f836feb62397bcc95991557738e872d12bed05
- SHA512 035225c2fd4ca0fe8972bd26cdfc2f1580f9bc4826193e3f273f66b0d8675ee24181935a6b0d7dce4fbde2768f4b0f5dea90f151084812edee59609a0adfdba2
- SSDEEP 192:5UpJw/pi3kjwuJYLicwJgGhGpFwKwnKsKQ:5UpJw6k0uRHJXkwKwK8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js
- Size 7KB
- SHA256 e48d325c213c149da8dadd739c0e5279b1fadac980ece81346a883fecbabfe6b
- MD5 54a1c2c82989d556e1c1e0403f70f93c
- SHA1 f0f836feb62397bcc95991557738e872d12bed05
- SHA512 035225c2fd4ca0fe8972bd26cdfc2f1580f9bc4826193e3f273f66b0d8675ee24181935a6b0d7dce4fbde2768f4b0f5dea90f151084812edee59609a0adfdba2
- SSDEEP 192:5UpJw/pi3kjwuJYLicwJgGhGpFwKwnKsKQ:5UpJw6k0uRHJXkwKwK8
- MD5 SHA1 SHA512 SSDEEP