Overview

overview

10

Static

static

1

Spec00301.js

windows7-x64

10

Spec00301.js

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    19-05-2023 06:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Spec00301.js

  • Size

    1.1MB

  • MD5

    2640b5851d4ff75bfc5c3ddf9cea67c7

  • SHA1

    377210fc1a662564fc2c88e0ee974b992bd396eb

  • SHA256

    51dd8819906a735ebf6cc646da4d4ed23937e66b39a55b0dca5b01e7a0ce3f6d

  • SHA512

    35ac8196a02b9e1a70cb8cc144b668f38eea87ba5645d102f384e7888423304108fe40d0b762e51d813cf1dbfbec1554c4dd1ef08f89718e17de6bc2a8821615

  • SSDEEP

    3072:znsMGGRlz5Hay9mgUAbud4dGkgvsGHgke6K7lV:R9ml4dGUmK7D

Score
10/10
wshratpersistencetrojan

Malware Config

Extracted

Family

wshrat

C2

http://45.90.222.125:7121

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Blocklisted process makes network request 9 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Spec00301.js
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Spec00301.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spec00301.js
    Filesize

    1.1MB

    MD5

    2640b5851d4ff75bfc5c3ddf9cea67c7

    SHA1

    377210fc1a662564fc2c88e0ee974b992bd396eb

    SHA256

    51dd8819906a735ebf6cc646da4d4ed23937e66b39a55b0dca5b01e7a0ce3f6d

    SHA512

    35ac8196a02b9e1a70cb8cc144b668f38eea87ba5645d102f384e7888423304108fe40d0b762e51d813cf1dbfbec1554c4dd1ef08f89718e17de6bc2a8821615

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spec00301.js
    Filesize

    1.1MB

    MD5

    2640b5851d4ff75bfc5c3ddf9cea67c7

    SHA1

    377210fc1a662564fc2c88e0ee974b992bd396eb

    SHA256

    51dd8819906a735ebf6cc646da4d4ed23937e66b39a55b0dca5b01e7a0ce3f6d

    SHA512

    35ac8196a02b9e1a70cb8cc144b668f38eea87ba5645d102f384e7888423304108fe40d0b762e51d813cf1dbfbec1554c4dd1ef08f89718e17de6bc2a8821615

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Spec00301.js
    Filesize

    1.1MB

    MD5

    2640b5851d4ff75bfc5c3ddf9cea67c7

    SHA1

    377210fc1a662564fc2c88e0ee974b992bd396eb

    SHA256

    51dd8819906a735ebf6cc646da4d4ed23937e66b39a55b0dca5b01e7a0ce3f6d

    SHA512

    35ac8196a02b9e1a70cb8cc144b668f38eea87ba5645d102f384e7888423304108fe40d0b762e51d813cf1dbfbec1554c4dd1ef08f89718e17de6bc2a8821615

    Download Submit
  • C:\Users\Admin\AppData\Roaming\wshsdk.zip
    Filesize

    12.4MB

    MD5

    d9a63dfd8b73629421bb44bcde09f312

    SHA1

    7855575c12eaee0e734f3901ca1da2931e9b587a

    SHA256

    9d5bb028794410fda9d1b3e0f8deb6beee5bd4e1e55340bd375a209c81dc98eb

    SHA512

    df195c22f7818569cc92e995846ab507caa30f341ac902cc8afe6f06ae4493709e7f80357c91cf14b21e58e2154e0b35f2154d8a313bf36fcff0b72b3a539cf8

    Download Submit
  • C:\Users\Admin\AppData\Roaming\wshsdk\Lib\SITE-P~1\adodbapi\test\is64bit.py
    Filesize

    1KB

    MD5

    ca2cc8e73bbca371935bbc92ed18d567

    SHA1

    1adb458919e842cd78c72b1ff00e5e93cb6ef75e

    SHA256

    bea3f797921992fda45c19db41e10e3b325bcdd3ea35d35c1fa70535477ad9c1

    SHA512

    b63df3bad9272f45ba0f50e2c50aaed7a04eb1b000d5855d9f3a8e5c5f2d381c667b1e9c1e1f03f80584a7941a96992838664ae9dd25e1b8320e026da35b8223

    Download Submit