Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2023 01:46
Static task
static1
Behavioral task
behavioral1
Sample
57333809-dbd0-4c22-b696-ed9d3682de21.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
57333809-dbd0-4c22-b696-ed9d3682de21.js
Resource
win10v2004-20220901-en
General
-
Target
57333809-dbd0-4c22-b696-ed9d3682de21.js
-
Size
285KB
-
MD5
3bbcc5d020c78a15e255fd64488ca85f
-
SHA1
7c51ef5035b77aa6557e6f4ecd87db3672d17703
-
SHA256
89f45442db86a345f88320a8d4f0b5f5ac49a8828181f98d62c30633821dffbf
-
SHA512
b4b756be58ea82a1c978cb5ee5b43b380976f5aa4ae9c25c567196bae678c72cb2316ed51a4964f2d62010926fc81695d8bdb9faef09579a67ba0314229d004b
-
SSDEEP
6144:7DrSmg1GX1AYjy8iRH8mwZBN50AbjAfjgauIOI4Jsu:7DrS1GXOut/59bjAf7O6u
Malware Config
Extracted
wshrat
http://oyo.powrkenken.info:46077
Signatures
-
Blocklisted process makes network request 42 IoCs
Processes:
wscript.exewscript.exeflow pid process 5 3476 wscript.exe 7 4848 wscript.exe 9 4848 wscript.exe 19 4848 wscript.exe 21 3476 wscript.exe 22 4848 wscript.exe 28 4848 wscript.exe 29 3476 wscript.exe 30 4848 wscript.exe 32 4848 wscript.exe 33 3476 wscript.exe 43 4848 wscript.exe 47 3476 wscript.exe 48 4848 wscript.exe 49 4848 wscript.exe 50 3476 wscript.exe 53 4848 wscript.exe 54 3476 wscript.exe 55 4848 wscript.exe 57 4848 wscript.exe 58 3476 wscript.exe 59 4848 wscript.exe 60 3476 wscript.exe 61 4848 wscript.exe 62 4848 wscript.exe 63 3476 wscript.exe 65 4848 wscript.exe 66 3476 wscript.exe 67 4848 wscript.exe 68 4848 wscript.exe 69 3476 wscript.exe 70 4848 wscript.exe 71 3476 wscript.exe 72 4848 wscript.exe 73 4848 wscript.exe 74 3476 wscript.exe 75 4848 wscript.exe 76 3476 wscript.exe 77 4848 wscript.exe 78 4848 wscript.exe 79 3476 wscript.exe 80 4848 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 4 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\57333809-dbd0-4c22-b696-ed9d3682de21.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\57333809-dbd0-4c22-b696-ed9d3682de21.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RaHgJwXdWG.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RaHgJwXdWG.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\57333809-dbd0-4c22-b696-ed9d3682de21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\57333809-dbd0-4c22-b696-ed9d3682de21.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\57333809-dbd0-4c22-b696-ed9d3682de21 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\57333809-dbd0-4c22-b696-ed9d3682de21.js\"" wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 25 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 9 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 53 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 55 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 72 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 75 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 80 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 22 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 28 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 32 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 57 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 61 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 62 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 59 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 68 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 73 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 78 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 67 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 70 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 19 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 30 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 43 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 48 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 49 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 65 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 77 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 8/2/2023|JavaScript-v3.4|IN:India -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
wscript.exedescription pid process target process PID 4848 wrote to memory of 3476 4848 wscript.exe wscript.exe PID 4848 wrote to memory of 3476 4848 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\57333809-dbd0-4c22-b696-ed9d3682de21.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\RaHgJwXdWG.js"2⤵
- Blocklisted process makes network request
- Drops startup file
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\RaHgJwXdWG.jsFilesize
17KB
MD5cb1c5cdb41d61208cee9a603b916dbda
SHA1633d907c3dfbbc8c8e225f199ca70c71e712d9b8
SHA256b6f076eaeb12e8926515c10fe39d933c89168e106faddecfa6d34bf307c569fb
SHA512602feac39680759414cdf1ab09399ce5478a0a601e956e75574e39571758b6a17633781766a054463ac09b45196f9ba46adc1394d4b6b2ba080d4899ec041f36
-
memory/3476-132-0x0000000000000000-mapping.dmp