Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
04/01/2023, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
ORDER-202304.docx.js
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ORDER-202304.docx.js
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target ORDER-202304.docx.js
- Size 457KB
- Sample230104-py86vafe57
- SHA256 25fd8ae45765211e3ea0aab0dd2630ab5311b05ffb6a55b4efd9cbb30e62ba58
- MD5 849d6a958c04675ea59c4d5f8ce1cc9b
- SHA1 800b213eddab81c419694724c493995ef3ec90b4
- SHA512 5228472d7f19bc66066aa7fea17791b14b3d49b4b0bc0998cfedf60284942599cfd50059e1f89aca20ee70a2d9ab2ad7d855d08ebd87c5748b84ea7f775c0c2a
- SSDEEP 384:7TMKXWRWW+YWWt9g5g7JWWWWWW3QWWWWWWCcqJaIGHI0e6pVODEKFEK3mm7PAAWC:7TMKXu
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
wshrat
C2
-
http://chongmei33.publicvm.com:7045
Signatures
- Blocklisted process makes network request 16 IoCs
flow pid Process 6 2728 wscript.exe 7 2728 wscript.exe 17 2728 wscript.exe 22 2728 wscript.exe 25 2728 wscript.exe 33 2728 wscript.exe 37 2728 wscript.exe 49 2728 wscript.exe 52 2728 wscript.exe 58 2728 wscript.exe 59 2728 wscript.exe 60 2728 wscript.exe 62 2728 wscript.exe 63 2728 wscript.exe 64 2728 wscript.exe 68 2728 wscript.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER-202304.docx.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER-202304.docx.js wscript.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ORDER-202304 = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\ORDER-202304.docx.js'" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ORDER-202304 = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\ORDER-202304.docx.js'" wscript.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\software\microsoft\windows\currentversion\run wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Script User-Agent 12 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 63 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript HTTP User-Agent header 68 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript HTTP User-Agent header 6 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript HTTP User-Agent header 33 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript HTTP User-Agent header 49 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript HTTP User-Agent header 60 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript HTTP User-Agent header 59 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript HTTP User-Agent header 62 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript HTTP User-Agent header 7 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript HTTP User-Agent header 17 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript HTTP User-Agent header 22 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript HTTP User-Agent header 58 WSHRAT|36C15E1A|WIJBFSKT|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/1/2023|JavaScript