Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08-05-2023 13:03

General

  • Target

    Scan0030.js

  • Size

    898KB

  • MD5

    b2b05e1631db082866c8f9d38cddf403

  • SHA1

    3f19e69b66bf8c50993b55e5744818e3e92d4156

  • SHA256

    c7805522f881cfa27c3cc92917f28da0f770d1e4ffe5aa170751058553da73ed

  • SHA512

    7b7f6ab57bb555e07bd39e21e1470ea73c2dc4c1fa97bc1bbfb3361f8f2659d503a445a90e4125556a2ceba4236f83a077961340c435db0e070a91f6269d4c56

  • SSDEEP

    6144:ROD297zg2plJPacQwE6hkpA0LysIfFk9jvCsYS9H17d9qFPNL6Z4MnJHI9Q6NCwU:+LP

Malware Config

Extracted

Family

wshrat

C2

http://45.90.222.125:7121

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

  • Blocklisted process makes network request 8 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Scan0030.js
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:272
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Scan0030.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:812

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scan0030.js

    Filesize

    898KB

    MD5

    b2b05e1631db082866c8f9d38cddf403

    SHA1

    3f19e69b66bf8c50993b55e5744818e3e92d4156

    SHA256

    c7805522f881cfa27c3cc92917f28da0f770d1e4ffe5aa170751058553da73ed

    SHA512

    7b7f6ab57bb555e07bd39e21e1470ea73c2dc4c1fa97bc1bbfb3361f8f2659d503a445a90e4125556a2ceba4236f83a077961340c435db0e070a91f6269d4c56

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scan0030.js

    Filesize

    898KB

    MD5

    b2b05e1631db082866c8f9d38cddf403

    SHA1

    3f19e69b66bf8c50993b55e5744818e3e92d4156

    SHA256

    c7805522f881cfa27c3cc92917f28da0f770d1e4ffe5aa170751058553da73ed

    SHA512

    7b7f6ab57bb555e07bd39e21e1470ea73c2dc4c1fa97bc1bbfb3361f8f2659d503a445a90e4125556a2ceba4236f83a077961340c435db0e070a91f6269d4c56

  • C:\Users\Admin\AppData\Roaming\Scan0030.js

    Filesize

    898KB

    MD5

    b2b05e1631db082866c8f9d38cddf403

    SHA1

    3f19e69b66bf8c50993b55e5744818e3e92d4156

    SHA256

    c7805522f881cfa27c3cc92917f28da0f770d1e4ffe5aa170751058553da73ed

    SHA512

    7b7f6ab57bb555e07bd39e21e1470ea73c2dc4c1fa97bc1bbfb3361f8f2659d503a445a90e4125556a2ceba4236f83a077961340c435db0e070a91f6269d4c56

  • C:\Users\Admin\AppData\Roaming\wshsdk.zip

    Filesize

    12.4MB

    MD5

    d9a63dfd8b73629421bb44bcde09f312

    SHA1

    7855575c12eaee0e734f3901ca1da2931e9b587a

    SHA256

    9d5bb028794410fda9d1b3e0f8deb6beee5bd4e1e55340bd375a209c81dc98eb

    SHA512

    df195c22f7818569cc92e995846ab507caa30f341ac902cc8afe6f06ae4493709e7f80357c91cf14b21e58e2154e0b35f2154d8a313bf36fcff0b72b3a539cf8