Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
12/12/2022, 17:00
Static task
static1
Behavioral task
behavioral1
Sample
doc00000024720000.js
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
doc00000024720000.js
Resource
win10v2004-20221111-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
doc00000024720000.js
-
Size
196KB
-
MD5
0a568e550259227e12d5fad3e44278d9
-
SHA1
ea93668fdfada948e617a98f2a9c1e60cca34cea
-
SHA256
660ade8ec5e8a4d96829bf974782baa25b76fe5626ae29a319ebb448b58a4a67
-
SHA512
e3aa2c5dfe9aa56dfc122c4d6c523665edae5555a66ea1f966efb95022811e961c0881c30c02e9d0f4115a19908c2961e188b4a1df7efff88141842b99b6f609
-
SSDEEP
3072:FIGmE69uz3ugounzuwdnnir6KjdbNelhkaJ:FIGmIto2zjdng6Kjj2J
Score
10/10
Malware Config
Extracted
Family
wshrat
C2
http://45.139.105.174:1604
Signatures
-
Blocklisted process makes network request 31 IoCs
flow pid Process 4 4284 wscript.exe 6 1700 wscript.exe 25 4284 wscript.exe 26 4284 wscript.exe 30 4284 wscript.exe 31 4284 wscript.exe 32 4284 wscript.exe 33 1700 wscript.exe 41 4284 wscript.exe 53 4284 wscript.exe 55 4284 wscript.exe 56 4284 wscript.exe 69 1700 wscript.exe 74 4284 wscript.exe 80 4284 wscript.exe 84 4284 wscript.exe 85 1700 wscript.exe 86 4284 wscript.exe 87 4284 wscript.exe 88 4284 wscript.exe 89 4284 wscript.exe 90 4284 wscript.exe 91 1700 wscript.exe 92 4284 wscript.exe 101 4284 wscript.exe 105 4284 wscript.exe 106 4284 wscript.exe 107 4284 wscript.exe 108 1700 wscript.exe 109 4284 wscript.exe 110 4284 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\doc00000024720000.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\doc00000024720000.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FKYImiPkzF.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FKYImiPkzF.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doc00000024720000 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\doc00000024720000.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\doc00000024720000 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\doc00000024720000.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 24 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 26 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 86 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 88 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 4 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 25 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 84 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 92 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 109 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 110 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 41 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 74 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 89 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 90 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 106 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 107 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 32 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 55 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 53 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 80 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 87 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 101 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 105 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 30 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript HTTP User-Agent header 31 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/12/2022|JavaScript -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4284 wrote to memory of 1700 4284 wscript.exe 84 PID 4284 wrote to memory of 1700 4284 wscript.exe 84
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\doc00000024720000.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\FKYImiPkzF.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:1700
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5384c972ff08ee2dabfff0c59daeff036
SHA1236f8d9b6a7f5aae53e5796d0525fdf21d773f64
SHA256ac8f80f836827fce59e2d5d20490a5b02b8e46263a5371b7f55f4f1fa741067c
SHA512dbbd68742cf7e8db9265195dbdacdf694ccd4a946241cb2be9b9510810206b71f7b4be50903b6f9b7854f5fa3a87a73e5aeb39fb1dbf12b8ce8cbaab01205c3b