Malware Analysis Report

2024-11-30 15:45

Sample ID 230124-rg9gdsdf3y
Target Solicitation#E62-359.pdf.js
SHA256 069428da73eef276063d954b097054ff9a31b9265d1472fc6e067d88f5be2a87
Tags
vjw0rm wshrat persistence trojan worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

069428da73eef276063d954b097054ff9a31b9265d1472fc6e067d88f5be2a87

Threat Level: Known bad

The file Solicitation#E62-359.pdf.js was found to be: Known bad.

Malicious Activity Summary

vjw0rm wshrat persistence trojan worm

WSHRAT

Vjw0rm

Blocklisted process makes network request

Drops startup file

Checks computer location settings

Adds Run key to start application

Drops file in System32 directory

Enumerates physical storage devices

Checks processor information in registry

Script User-Agent

Enumerates system info in registry

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-01-24 14:11

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-24 14:11

Reported

2023-01-24 14:13

Platform

win7-20221111-en

Max time kernel

150s

Max time network

151s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\Solicitation#E62-359.pdf.js

Signatures

Vjw0rm

trojan worm vjw0rm

WSHRAT

trojan wshrat

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicitation#E62-359.pdf.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicitation#E62-359.pdf.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js C:\Windows\System32\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\"" C:\Windows\system32\wscript.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|DC37C744|SABDUHNY|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 24/1/2023|JavaScript N/A N/A

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Solicitation#E62-359.pdf.js

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Solicitation#E62-359.pdf.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 javaautorun.duia.ro udp
N/A 8.8.8.8:53 bona.kasowiitz.com udp
N/A 8.8.8.8:53 javaautorun.duia.ro udp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp

Files

memory/1304-54-0x0000000000000000-mapping.dmp

memory/568-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js

MD5 feb390b3400f155e4df8ddb4c2e6a121
SHA1 0c12b706f2b3b1a2db0a2693a8942e14176f56db
SHA256 ab755cf1ba6577b20e2a366910a2bfc9b20cd75c6ac0f4afacb5936e43598902
SHA512 abd24d26576fe88d013e90521d533b182cdcce0085e238d5312840747bd3d854abfc5c218c5ef4e6c8a14e35ba61ac45db8d05ec9a8f73eb7d711c901caa9b0a

C:\Users\Admin\AppData\Roaming\Solicitation#E62-359.pdf.js

MD5 4e2d729e9c8329faf413b544c6e3e142
SHA1 a2e1e676ef6be73c851acbaf46b00eb8635fb875
SHA256 069428da73eef276063d954b097054ff9a31b9265d1472fc6e067d88f5be2a87
SHA512 24f0eeec9c97dbd77601c46bf2cd4ae02ebfc23f291367d1308a369df8b5f48794a11ec5720853e8507a1fa576d4b9164231ca65a4c7fa12fc7219d3ed86917f

memory/336-58-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicitation#E62-359.pdf.js

MD5 4e2d729e9c8329faf413b544c6e3e142
SHA1 a2e1e676ef6be73c851acbaf46b00eb8635fb875
SHA256 069428da73eef276063d954b097054ff9a31b9265d1472fc6e067d88f5be2a87
SHA512 24f0eeec9c97dbd77601c46bf2cd4ae02ebfc23f291367d1308a369df8b5f48794a11ec5720853e8507a1fa576d4b9164231ca65a4c7fa12fc7219d3ed86917f

C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js

MD5 feb390b3400f155e4df8ddb4c2e6a121
SHA1 0c12b706f2b3b1a2db0a2693a8942e14176f56db
SHA256 ab755cf1ba6577b20e2a366910a2bfc9b20cd75c6ac0f4afacb5936e43598902
SHA512 abd24d26576fe88d013e90521d533b182cdcce0085e238d5312840747bd3d854abfc5c218c5ef4e6c8a14e35ba61ac45db8d05ec9a8f73eb7d711c901caa9b0a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js

MD5 feb390b3400f155e4df8ddb4c2e6a121
SHA1 0c12b706f2b3b1a2db0a2693a8942e14176f56db
SHA256 ab755cf1ba6577b20e2a366910a2bfc9b20cd75c6ac0f4afacb5936e43598902
SHA512 abd24d26576fe88d013e90521d533b182cdcce0085e238d5312840747bd3d854abfc5c218c5ef4e6c8a14e35ba61ac45db8d05ec9a8f73eb7d711c901caa9b0a

Analysis: behavioral2

Detonation Overview

Submitted

2023-01-24 14:11

Reported

2023-01-24 14:13

Platform

win10v2004-20220812-en

Max time kernel

149s

Max time network

152s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\Solicitation#E62-359.pdf.js

Signatures

Vjw0rm

trojan worm vjw0rm

WSHRAT

trojan wshrat

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Windows\System32\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicitation#E62-359.pdf.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicitation#E62-359.pdf.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js C:\Windows\System32\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{C36E2E2B-1295-4435-A8CD-32C22ABA46F3}.catalogItem C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{72812B47-285B-4878-A6D9-EA17A2B1F15E}.catalogItem C:\Windows\System32\svchost.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\System32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\System32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\System32\svchost.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\System32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\System32\svchost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 24/1/2023|JavaScript N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1404 wrote to memory of 3964 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1404 wrote to memory of 3964 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1404 wrote to memory of 1996 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1404 wrote to memory of 1996 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1996 wrote to memory of 4844 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe
PID 1996 wrote to memory of 4844 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\Solicitation#E62-359.pdf.js

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Solicitation#E62-359.pdf.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 javaautorun.duia.ro udp
N/A 8.8.8.8:53 bona.kasowiitz.com udp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 91.193.75.231:5443 javaautorun.duia.ro tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp
N/A 5.253.114.102:50125 bona.kasowiitz.com tcp

Files

memory/3964-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js

MD5 feb390b3400f155e4df8ddb4c2e6a121
SHA1 0c12b706f2b3b1a2db0a2693a8942e14176f56db
SHA256 ab755cf1ba6577b20e2a366910a2bfc9b20cd75c6ac0f4afacb5936e43598902
SHA512 abd24d26576fe88d013e90521d533b182cdcce0085e238d5312840747bd3d854abfc5c218c5ef4e6c8a14e35ba61ac45db8d05ec9a8f73eb7d711c901caa9b0a

memory/1996-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Solicitation#E62-359.pdf.js

MD5 4e2d729e9c8329faf413b544c6e3e142
SHA1 a2e1e676ef6be73c851acbaf46b00eb8635fb875
SHA256 069428da73eef276063d954b097054ff9a31b9265d1472fc6e067d88f5be2a87
SHA512 24f0eeec9c97dbd77601c46bf2cd4ae02ebfc23f291367d1308a369df8b5f48794a11ec5720853e8507a1fa576d4b9164231ca65a4c7fa12fc7219d3ed86917f

memory/4844-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicitation#E62-359.pdf.js

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js

MD5 feb390b3400f155e4df8ddb4c2e6a121
SHA1 0c12b706f2b3b1a2db0a2693a8942e14176f56db
SHA256 ab755cf1ba6577b20e2a366910a2bfc9b20cd75c6ac0f4afacb5936e43598902
SHA512 abd24d26576fe88d013e90521d533b182cdcce0085e238d5312840747bd3d854abfc5c218c5ef4e6c8a14e35ba61ac45db8d05ec9a8f73eb7d711c901caa9b0a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js

MD5 feb390b3400f155e4df8ddb4c2e6a121
SHA1 0c12b706f2b3b1a2db0a2693a8942e14176f56db
SHA256 ab755cf1ba6577b20e2a366910a2bfc9b20cd75c6ac0f4afacb5936e43598902
SHA512 abd24d26576fe88d013e90521d533b182cdcce0085e238d5312840747bd3d854abfc5c218c5ef4e6c8a14e35ba61ac45db8d05ec9a8f73eb7d711c901caa9b0a