Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2022, 08:30
Static task
static1
Behavioral task
behavioral1
Sample
BCGroup-191222-Order.js
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
BCGroup-191222-Order.js
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
BCGroup-191222-Order.js
-
Size
601KB
-
MD5
40918a71cd25cc1820b6e6e53bf0728d
-
SHA1
36761e8095259d13927cba982861e88df9ab501f
-
SHA256
4c9c294340ea1d2c1fc760fb5d5d55c378de7e369134bd1ac0c16bcad545af76
-
SHA512
4589969fe1752d1538383681be26ee8b95866b5794b104cf369cc81eadce237138ba68a9e9779cb56e7bcf4fa131cf71c569aaaac1a749b5976fa93e3fce56f6
-
SSDEEP
3072:CTw2WBCzajIMRoRO+Qchbchh3WZ/LKmWx1AKhKq+daJpOJVK5f9Ll/kFQkOzeI5k:CttlBQIcGsLlb3R7RSvTOUntCzp4W8
Score
10/10
Malware Config
Extracted
Family
wshrat
C2
http://45.139.105.174:1604
Signatures
-
Blocklisted process makes network request 35 IoCs
flow pid Process 5 4332 wscript.exe 6 564 wscript.exe 17 4332 wscript.exe 18 4332 wscript.exe 32 4332 wscript.exe 52 4332 wscript.exe 72 4332 wscript.exe 77 564 wscript.exe 89 4332 wscript.exe 90 4332 wscript.exe 92 4332 wscript.exe 93 4332 wscript.exe 99 4332 wscript.exe 100 564 wscript.exe 101 4332 wscript.exe 103 4332 wscript.exe 104 4332 wscript.exe 105 4332 wscript.exe 107 4332 wscript.exe 108 564 wscript.exe 109 4332 wscript.exe 110 4332 wscript.exe 111 4332 wscript.exe 112 4332 wscript.exe 113 4332 wscript.exe 114 4332 wscript.exe 115 564 wscript.exe 116 4332 wscript.exe 117 4332 wscript.exe 118 4332 wscript.exe 119 4332 wscript.exe 120 4332 wscript.exe 121 564 wscript.exe 122 4332 wscript.exe 123 4332 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BCGroup-191222-Order.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BCGroup-191222-Order.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NeCfiNUwzW.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NeCfiNUwzW.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BCGroup-191222-Order = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\BCGroup-191222-Order.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BCGroup-191222-Order = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\BCGroup-191222-Order.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 28 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 52 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 110 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 92 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 118 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 119 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 72 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 104 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 112 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 101 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 109 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 122 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 111 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 113 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 116 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 117 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 120 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 5 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 18 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 93 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 99 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 105 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 114 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 90 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 103 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 107 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 17 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 32 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript HTTP User-Agent header 89 WSHRAT|94D95F5C|GBQHURCC|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/12/2022|JavaScript -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4332 wrote to memory of 564 4332 wscript.exe 80 PID 4332 wrote to memory of 564 4332 wscript.exe 80
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\BCGroup-191222-Order.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\NeCfiNUwzW.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:564
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD556d031be7e18c48c72c4f5a7ee653bd3
SHA1ad3e60fb10c30b470d0d3a56a4b6df05b52a5158
SHA256ef88fee65a5658a478e1f500a11f004084bf9b8c1c6ddbf8bdf3fd1e0c664e46
SHA512fe8670f8d9d539e65d60fe2528d5c7fc59d08ec57cff6d60b18842785f3d5414eaaaf66a9de92164a8321ea9c7081b01698a6e76cf8227b84322369eb90e7070