Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08-05-2023 13:03
Static task
static1
Behavioral task
behavioral1
Sample
Scan0030.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Scan0030.js
Resource
win10v2004-20230220-en
General
-
Target
Scan0030.js
-
Size
898KB
-
MD5
b2b05e1631db082866c8f9d38cddf403
-
SHA1
3f19e69b66bf8c50993b55e5744818e3e92d4156
-
SHA256
c7805522f881cfa27c3cc92917f28da0f770d1e4ffe5aa170751058553da73ed
-
SHA512
7b7f6ab57bb555e07bd39e21e1470ea73c2dc4c1fa97bc1bbfb3361f8f2659d503a445a90e4125556a2ceba4236f83a077961340c435db0e070a91f6269d4c56
-
SSDEEP
6144:ROD297zg2plJPacQwE6hkpA0LysIfFk9jvCsYS9H17d9qFPNL6Z4MnJHI9Q6NCwU:+LP
Malware Config
Extracted
wshrat
http://45.90.222.125:7121
Signatures
-
Blocklisted process makes network request 8 IoCs
flow pid Process 2 272 wscript.exe 3 812 wscript.exe 7 812 wscript.exe 8 812 wscript.exe 9 812 wscript.exe 11 812 wscript.exe 12 812 wscript.exe 14 812 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scan0030.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scan0030.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Scan0030 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Scan0030.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\Scan0030 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Scan0030.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Scan0030 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Scan0030.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\Scan0030 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Scan0030.js\"" wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 8 WSHRAT|F4C6D0E0|WFSTZEPN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 9 WSHRAT|F4C6D0E0|WFSTZEPN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 11 WSHRAT|F4C6D0E0|WFSTZEPN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 12 WSHRAT|F4C6D0E0|WFSTZEPN|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/5/2023|JavaScript-v3.4|IN:India -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 272 wrote to memory of 812 272 wscript.exe 29 PID 272 wrote to memory of 812 272 wscript.exe 29 PID 272 wrote to memory of 812 272 wscript.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Scan0030.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Scan0030.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:812
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
898KB
MD5b2b05e1631db082866c8f9d38cddf403
SHA13f19e69b66bf8c50993b55e5744818e3e92d4156
SHA256c7805522f881cfa27c3cc92917f28da0f770d1e4ffe5aa170751058553da73ed
SHA5127b7f6ab57bb555e07bd39e21e1470ea73c2dc4c1fa97bc1bbfb3361f8f2659d503a445a90e4125556a2ceba4236f83a077961340c435db0e070a91f6269d4c56
-
Filesize
898KB
MD5b2b05e1631db082866c8f9d38cddf403
SHA13f19e69b66bf8c50993b55e5744818e3e92d4156
SHA256c7805522f881cfa27c3cc92917f28da0f770d1e4ffe5aa170751058553da73ed
SHA5127b7f6ab57bb555e07bd39e21e1470ea73c2dc4c1fa97bc1bbfb3361f8f2659d503a445a90e4125556a2ceba4236f83a077961340c435db0e070a91f6269d4c56
-
Filesize
898KB
MD5b2b05e1631db082866c8f9d38cddf403
SHA13f19e69b66bf8c50993b55e5744818e3e92d4156
SHA256c7805522f881cfa27c3cc92917f28da0f770d1e4ffe5aa170751058553da73ed
SHA5127b7f6ab57bb555e07bd39e21e1470ea73c2dc4c1fa97bc1bbfb3361f8f2659d503a445a90e4125556a2ceba4236f83a077961340c435db0e070a91f6269d4c56
-
Filesize
12.4MB
MD5d9a63dfd8b73629421bb44bcde09f312
SHA17855575c12eaee0e734f3901ca1da2931e9b587a
SHA2569d5bb028794410fda9d1b3e0f8deb6beee5bd4e1e55340bd375a209c81dc98eb
SHA512df195c22f7818569cc92e995846ab507caa30f341ac902cc8afe6f06ae4493709e7f80357c91cf14b21e58e2154e0b35f2154d8a313bf36fcff0b72b3a539cf8