Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
15-02-2023 15:07
Static task
static1
Behavioral task
behavioral1
Sample
HK SEMI CORPORATION CO,,Ltd.js
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
HK SEMI CORPORATION CO,,Ltd.js
Resource
win10v2004-20220901-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
HK SEMI CORPORATION CO,,Ltd.js
-
Size
3.5MB
-
MD5
fb91a4c36c78fec96b1aef40d2d59c5f
-
SHA1
6f80bcc9f8485e7486fc716c47e1f611d688649c
-
SHA256
fb578011fca33b512fe0f1b92cc192e57fee479a40a53e981ec61ab220b0922d
-
SHA512
77fd763cb36519248f72a9f821bd421733099e47510d508644cb616e8c321c9b9d7aaffe86f1da8c0023a90230263e32c62b73efe5ed31a304ab7d043820d38a
-
SSDEEP
6144:DDvsgmpFYY2BrelpSK0XjJr0JS3ZgFt6r6ZpT:DD7Yvt
Score
10/10
Malware Config
Extracted
Family
wshrat
C2
http://45.139.105.174:1604
Signatures
-
Blocklisted process makes network request 46 IoCs
flow pid Process 5 4000 wscript.exe 6 1720 wscript.exe 11 1720 wscript.exe 12 4000 wscript.exe 13 1720 wscript.exe 20 1720 wscript.exe 25 4000 wscript.exe 26 1720 wscript.exe 27 1720 wscript.exe 33 4000 wscript.exe 41 1720 wscript.exe 45 1720 wscript.exe 46 4000 wscript.exe 47 1720 wscript.exe 48 4000 wscript.exe 49 1720 wscript.exe 52 1720 wscript.exe 53 4000 wscript.exe 54 1720 wscript.exe 56 1720 wscript.exe 57 4000 wscript.exe 58 1720 wscript.exe 59 1720 wscript.exe 60 4000 wscript.exe 61 1720 wscript.exe 63 1720 wscript.exe 64 4000 wscript.exe 65 1720 wscript.exe 66 4000 wscript.exe 67 1720 wscript.exe 68 1720 wscript.exe 69 4000 wscript.exe 70 1720 wscript.exe 71 1720 wscript.exe 72 4000 wscript.exe 73 1720 wscript.exe 74 1720 wscript.exe 75 4000 wscript.exe 76 1720 wscript.exe 77 1720 wscript.exe 78 4000 wscript.exe 79 1720 wscript.exe 80 4000 wscript.exe 81 1720 wscript.exe 82 1720 wscript.exe 83 4000 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HK SEMI CORPORATION CO,,Ltd.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HK SEMI CORPORATION CO,,Ltd.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MseIaECScV.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MseIaECScV.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HK SEMI CORPORATION CO,,Ltd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\HK SEMI CORPORATION CO,,Ltd.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HK SEMI CORPORATION CO,,Ltd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\HK SEMI CORPORATION CO,,Ltd.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 29 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 6 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 20 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 52 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 54 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 76 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 63 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 81 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 26 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 45 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 71 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 27 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 49 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 61 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 77 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 74 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 82 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 13 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 59 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 68 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 11 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 41 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 47 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 56 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 58 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 65 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 67 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 70 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 73 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript HTTP User-Agent header 79 WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/2/2023|JavaScript -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1720 wrote to memory of 4000 1720 wscript.exe 84 PID 1720 wrote to memory of 4000 1720 wscript.exe 84
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\HK SEMI CORPORATION CO,,Ltd.js"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\MseIaECScV.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:4000
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
346KB
MD5339289603df3318aca13df3fbd83cb1d
SHA14319d597b9c8aa40be2ad7ad87667f486494313f
SHA256252010fbdb5abc2de7f75cbf36fe37c9ad29c768b28eeba93de9208ea9ecba3a
SHA512d35daf3b50e3210a2c59c2dc4ebd377c6eba29811aa509b706184129bf3e17d369c007ec4e676bb4a597fe13b85fedd221a559a445d6315ed787b76f42c9305a