Overview

overview

10

Static

static

1

Scan005.js

windows7-x64

10

Scan005.js

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05-05-2023 12:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Scan005.js

  • Size

    2.2MB

  • MD5

    2d062c28da9b8e55c554ad3d99e26050

  • SHA1

    e80b8cb06e3665f13ef7d428e15b1fa4bdf9bc4e

  • SHA256

    ab7979631ae5e162281582ad3333e8943f0b908ef48d84c4de69e7616fef6931

  • SHA512

    b9319bfeca863d2c0d7fdadb20220b7040fa3880335ce0c73ee1f756fe3c16ce028f4b2df0e02a0de0f7a960512b82effeffab4b686900a4631460fb5cf7c5f3

  • SSDEEP

    6144:DVAv1mgQSIkYpI83y6acJmwj/9VwM4ccOrxMJ1MdrqJvNU3Wb/D4cn7XtK2T/kDg:oo71G

Score
10/10
agentteslawshratcollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Family

wshrat

C2

http://45.90.222.125:7121

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Blocklisted process makes network request 27 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 26 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Scan005.js
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\Scan005.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:684
      • C:\Users\Admin\Gmhot.exe
        "C:\Users\Admin\Gmhot.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • outlook_office_path
        • outlook_win_path
        PID:688

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scan005.js
    Filesize

    2.2MB

    MD5

    2d062c28da9b8e55c554ad3d99e26050

    SHA1

    e80b8cb06e3665f13ef7d428e15b1fa4bdf9bc4e

    SHA256

    ab7979631ae5e162281582ad3333e8943f0b908ef48d84c4de69e7616fef6931

    SHA512

    b9319bfeca863d2c0d7fdadb20220b7040fa3880335ce0c73ee1f756fe3c16ce028f4b2df0e02a0de0f7a960512b82effeffab4b686900a4631460fb5cf7c5f3

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scan005.js
    Filesize

    2.2MB

    MD5

    2d062c28da9b8e55c554ad3d99e26050

    SHA1

    e80b8cb06e3665f13ef7d428e15b1fa4bdf9bc4e

    SHA256

    ab7979631ae5e162281582ad3333e8943f0b908ef48d84c4de69e7616fef6931

    SHA512

    b9319bfeca863d2c0d7fdadb20220b7040fa3880335ce0c73ee1f756fe3c16ce028f4b2df0e02a0de0f7a960512b82effeffab4b686900a4631460fb5cf7c5f3

    Download Submit

  • C:\Users\Admin\AppData\Roaming\PkvdRn\PkvdRn.exe
    Filesize

    165KB

    MD5

    9174c08e0ea67a940b29c2464e6c762e

    SHA1

    65e3a13c5c8004fcdfe0603a03d6ef127fe68881

    SHA256

    9108ee00bdf6e89257bed6e57902ec4ea496c1b90ff659e41927a30ef4a98d49

    SHA512

    0611ed661fc0b5e559d5998a053ee78da935e7d6af875ec69f00b5b8d26f0521712051ec110ba534cc5a9969c369f05082bc98dfeabb0c481dbd0464991643e2

    Download Submit

  • C:\Users\Admin\Gmhot.exe
    Filesize

    165KB

    MD5

    9174c08e0ea67a940b29c2464e6c762e

    SHA1

    65e3a13c5c8004fcdfe0603a03d6ef127fe68881

    SHA256

    9108ee00bdf6e89257bed6e57902ec4ea496c1b90ff659e41927a30ef4a98d49

    SHA512

    0611ed661fc0b5e559d5998a053ee78da935e7d6af875ec69f00b5b8d26f0521712051ec110ba534cc5a9969c369f05082bc98dfeabb0c481dbd0464991643e2

    Download Submit

  • C:\Users\Admin\Gmhot.exe
    Filesize

    165KB

    MD5

    9174c08e0ea67a940b29c2464e6c762e

    SHA1

    65e3a13c5c8004fcdfe0603a03d6ef127fe68881

    SHA256

    9108ee00bdf6e89257bed6e57902ec4ea496c1b90ff659e41927a30ef4a98d49

    SHA512

    0611ed661fc0b5e559d5998a053ee78da935e7d6af875ec69f00b5b8d26f0521712051ec110ba534cc5a9969c369f05082bc98dfeabb0c481dbd0464991643e2

    Download Submit

  • C:\Users\Admin\Scan005.js
    Filesize

    2.2MB

    MD5

    2d062c28da9b8e55c554ad3d99e26050

    SHA1

    e80b8cb06e3665f13ef7d428e15b1fa4bdf9bc4e

    SHA256

    ab7979631ae5e162281582ad3333e8943f0b908ef48d84c4de69e7616fef6931

    SHA512

    b9319bfeca863d2c0d7fdadb20220b7040fa3880335ce0c73ee1f756fe3c16ce028f4b2df0e02a0de0f7a960512b82effeffab4b686900a4631460fb5cf7c5f3

    Download Submit

  • memory/688-67-0x0000000000090000-0x00000000000C0000-memory.dmp

    Filesize

    192KB

    Download

  • memory/688-68-0x0000000001FC0000-0x0000000002000000-memory.dmp

    Filesize

    256KB

    Download

  • memory/688-89-0x0000000001FC0000-0x0000000002000000-memory.dmp

    Filesize

    256KB

    Download