Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-02-2023 01:46
Static task
static1
Behavioral task
behavioral1
Sample
57333809-dbd0-4c22-b696-ed9d3682de21.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
57333809-dbd0-4c22-b696-ed9d3682de21.js
Resource
win10v2004-20220901-en
General
-
Target
57333809-dbd0-4c22-b696-ed9d3682de21.js
-
Size
285KB
-
MD5
3bbcc5d020c78a15e255fd64488ca85f
-
SHA1
7c51ef5035b77aa6557e6f4ecd87db3672d17703
-
SHA256
89f45442db86a345f88320a8d4f0b5f5ac49a8828181f98d62c30633821dffbf
-
SHA512
b4b756be58ea82a1c978cb5ee5b43b380976f5aa4ae9c25c567196bae678c72cb2316ed51a4964f2d62010926fc81695d8bdb9faef09579a67ba0314229d004b
-
SSDEEP
6144:7DrSmg1GX1AYjy8iRH8mwZBN50AbjAfjgauIOI4Jsu:7DrS1GXOut/59bjAf7O6u
Malware Config
Extracted
wshrat
http://oyo.powrkenken.info:46077
Signatures
-
Blocklisted process makes network request 41 IoCs
Processes:
wscript.exewscript.exeflow pid process 7 1116 wscript.exe 8 1688 wscript.exe 10 1116 wscript.exe 11 1116 wscript.exe 12 1688 wscript.exe 13 1116 wscript.exe 16 1116 wscript.exe 17 1688 wscript.exe 19 1116 wscript.exe 21 1688 wscript.exe 22 1116 wscript.exe 26 1116 wscript.exe 27 1688 wscript.exe 29 1116 wscript.exe 30 1688 wscript.exe 32 1116 wscript.exe 35 1688 wscript.exe 36 1116 wscript.exe 37 1116 wscript.exe 39 1688 wscript.exe 40 1116 wscript.exe 42 1688 wscript.exe 43 1116 wscript.exe 45 1116 wscript.exe 47 1688 wscript.exe 48 1116 wscript.exe 50 1116 wscript.exe 51 1688 wscript.exe 52 1116 wscript.exe 54 1688 wscript.exe 55 1116 wscript.exe 58 1116 wscript.exe 59 1688 wscript.exe 60 1116 wscript.exe 62 1688 wscript.exe 63 1116 wscript.exe 65 1116 wscript.exe 66 1688 wscript.exe 68 1116 wscript.exe 70 1688 wscript.exe 71 1116 wscript.exe -
Drops startup file 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RaHgJwXdWG.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RaHgJwXdWG.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\57333809-dbd0-4c22-b696-ed9d3682de21.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\57333809-dbd0-4c22-b696-ed9d3682de21.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\57333809-dbd0-4c22-b696-ed9d3682de21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\57333809-dbd0-4c22-b696-ed9d3682de21.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\57333809-dbd0-4c22-b696-ed9d3682de21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\57333809-dbd0-4c22-b696-ed9d3682de21.js\"" wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 24 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 10 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 19 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 36 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 58 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 60 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 65 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 71 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 16 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 26 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 37 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 43 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 50 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 55 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 11 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 13 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 45 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 63 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 68 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 22 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 29 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 32 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 40 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 48 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 52 WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1116 wrote to memory of 1688 1116 wscript.exe wscript.exe PID 1116 wrote to memory of 1688 1116 wscript.exe wscript.exe PID 1116 wrote to memory of 1688 1116 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\57333809-dbd0-4c22-b696-ed9d3682de21.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\RaHgJwXdWG.js"2⤵
- Blocklisted process makes network request
- Drops startup file
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\RaHgJwXdWG.jsFilesize
17KB
MD5cb1c5cdb41d61208cee9a603b916dbda
SHA1633d907c3dfbbc8c8e225f199ca70c71e712d9b8
SHA256b6f076eaeb12e8926515c10fe39d933c89168e106faddecfa6d34bf307c569fb
SHA512602feac39680759414cdf1ab09399ce5478a0a601e956e75574e39571758b6a17633781766a054463ac09b45196f9ba46adc1394d4b6b2ba080d4899ec041f36
-
memory/1116-54-0x000007FEFC431000-0x000007FEFC433000-memory.dmpFilesize
8KB
-
memory/1688-55-0x0000000000000000-mapping.dmp