Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2023, 00:51
Static task
static1
Behavioral task
behavioral1
Sample
PurchaseOrder.js
Resource
win7-20230220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
PurchaseOrder.js
Resource
win10v2004-20230220-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target PurchaseOrder.js
- Size 628KB
- Sample230404-a7gqmaca32
- SHA256 ad3a780c4487e14936c1ea36f3ef998ba04d99a004b7da28b5d587c8be8a1872
- MD5 bf4b4d13001246b1c5f29779c5cabd1f
- SHA1 5512c70c30c573f7205e61f5d4397fa85482f52f
- SHA512 dceb174b1040ba21e8046f9da3d0c2657c03b4bac2ba1e87eed73ca711c69927e2215d68955628cddec318138da48dfead84f516c26851f2078ead3fcb2909ce
- SSDEEP 1536:HLL3LLtLLoLLKLLYLL3LLtLLoLLKLL3LLoLLKLLVLLZLLqLLmLLiLLPLLNLL7LLp:CWNMhWoyfFEXFVq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
wshrat
C2
-
http://chongmei33.publicvm.com:7045
Signatures
- Blocklisted process makes network request 27 IoCs
flow pid Process 17 2128 WScript.exe 19 2128 WScript.exe 25 2128 WScript.exe 26 2128 WScript.exe 27 2128 WScript.exe 37 2128 WScript.exe 38 2128 WScript.exe 40 2128 WScript.exe 44 2128 WScript.exe 48 2128 WScript.exe 49 2128 WScript.exe 51 2128 WScript.exe 52 2128 WScript.exe 55 2128 WScript.exe 56 2128 WScript.exe 57 2128 WScript.exe 58 2128 WScript.exe 59 2128 WScript.exe 60 2128 WScript.exe 61 2128 WScript.exe 62 2128 WScript.exe 63 2128 WScript.exe 66 2128 WScript.exe 67 2128 WScript.exe 68 2128 WScript.exe 69 2128 WScript.exe 70 2128 WScript.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation wscript.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.js WScript.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.js'" WScript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.js'" WScript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings wscript.exe - Script User-Agent 27 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 49 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 56 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 59 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 17 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 38 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 44 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 51 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 66 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 70 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 68 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 69 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 19 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 52 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 57 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 58 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 62 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 67 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 25 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 27 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 40 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 26 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 48 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 63 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 60 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 61 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 37 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript HTTP User-Agent header 55 WSHRAT|924C16C7|OZADSVWH|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 4/4/2023|JavaScript - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1344 wrote to memory of 2128 1344 wscript.exe 83 PID 1344 wrote to memory of 2128 1344 wscript.exe 83
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder.js1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\windows.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2128
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\windows.js
- Size 453KB
- SHA256 4f0b855a0e1741d5f31f887eda41d1848cb5fa6eee6f5712b8a4addcc832af00
- MD5 d64b750c40fef10eb31a9b2804fda242
- SHA1 a54191cd2306cc0dc0ad03e01aa380215c97dc31
- SHA512 a6c6d86c083895683a4ef74706c5b70e085200afd623d67d5fcf833bfbfa8eb48baf66afbb31c8ae7155af3e9565a441ab594f2933071d7ca60f976b3ba80e9a
- SSDEEP 192:WnJbPjiExFXSSTiFzHJhNFzLjn24sw4ODSOdOFOeAlVMfd:MbbBOzL8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.js
- Size 453KB
- SHA256 4f0b855a0e1741d5f31f887eda41d1848cb5fa6eee6f5712b8a4addcc832af00
- MD5 d64b750c40fef10eb31a9b2804fda242
- SHA1 a54191cd2306cc0dc0ad03e01aa380215c97dc31
- SHA512 a6c6d86c083895683a4ef74706c5b70e085200afd623d67d5fcf833bfbfa8eb48baf66afbb31c8ae7155af3e9565a441ab594f2933071d7ca60f976b3ba80e9a
- SSDEEP 192:WnJbPjiExFXSSTiFzHJhNFzLjn24sw4ODSOdOFOeAlVMfd:MbbBOzL8
- MD5 SHA1 SHA512 SSDEEP