Analysis

  • max time kernel
    132s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    19-05-2023 06:41

General

  • Target

    05162023.js

  • Size

    992KB

  • MD5

    261c683cdd89ac3ca4bbbd2fd7293c7f

  • SHA1

    9bf5f09bfb3260d4fea80896c3bb1b3354cb714f

  • SHA256

    0953de8a253fe24fc1a889c903f246a455daf9d5f608931fecbf07bc6f9690cc

  • SHA512

    f517e598e7b73cf2bf828ca1ef8e181dd6950bc41126f04fc768e6137bd4debbb169c9e5544968d395c3d50441e721b64b1b4f6789520058afa686bc409a80b7

  • SSDEEP

    3072:y87FJ6J9iYlueZkFrOdvQzU6FOoctj06BTZf4pcLYnGMhfWVbCh3:y87FJ6J9iYlueZkFrq06ff4pH0gh3

Malware Config

Extracted

Family

wshrat

C2

http://45.90.222.125:7121

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

  • Blocklisted process makes network request 8 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\05162023.js
    1⤵
    • Blocklisted process makes network request
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\05162023.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:324

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\05162023.js
    Filesize

    992KB

    MD5

    261c683cdd89ac3ca4bbbd2fd7293c7f

    SHA1

    9bf5f09bfb3260d4fea80896c3bb1b3354cb714f

    SHA256

    0953de8a253fe24fc1a889c903f246a455daf9d5f608931fecbf07bc6f9690cc

    SHA512

    f517e598e7b73cf2bf828ca1ef8e181dd6950bc41126f04fc768e6137bd4debbb169c9e5544968d395c3d50441e721b64b1b4f6789520058afa686bc409a80b7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05162023.js
    Filesize

    992KB

    MD5

    261c683cdd89ac3ca4bbbd2fd7293c7f

    SHA1

    9bf5f09bfb3260d4fea80896c3bb1b3354cb714f

    SHA256

    0953de8a253fe24fc1a889c903f246a455daf9d5f608931fecbf07bc6f9690cc

    SHA512

    f517e598e7b73cf2bf828ca1ef8e181dd6950bc41126f04fc768e6137bd4debbb169c9e5544968d395c3d50441e721b64b1b4f6789520058afa686bc409a80b7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05162023.js
    Filesize

    992KB

    MD5

    261c683cdd89ac3ca4bbbd2fd7293c7f

    SHA1

    9bf5f09bfb3260d4fea80896c3bb1b3354cb714f

    SHA256

    0953de8a253fe24fc1a889c903f246a455daf9d5f608931fecbf07bc6f9690cc

    SHA512

    f517e598e7b73cf2bf828ca1ef8e181dd6950bc41126f04fc768e6137bd4debbb169c9e5544968d395c3d50441e721b64b1b4f6789520058afa686bc409a80b7

  • C:\Users\Admin\AppData\Roaming\wshsdk.zip
    Filesize

    12.4MB

    MD5

    d9a63dfd8b73629421bb44bcde09f312

    SHA1

    7855575c12eaee0e734f3901ca1da2931e9b587a

    SHA256

    9d5bb028794410fda9d1b3e0f8deb6beee5bd4e1e55340bd375a209c81dc98eb

    SHA512

    df195c22f7818569cc92e995846ab507caa30f341ac902cc8afe6f06ae4493709e7f80357c91cf14b21e58e2154e0b35f2154d8a313bf36fcff0b72b3a539cf8

  • C:\Users\Admin\AppData\Roaming\wshsdk\Lib\SITE-P~1\adodbapi\test\is64bit.py
    Filesize

    1KB

    MD5

    ca2cc8e73bbca371935bbc92ed18d567

    SHA1

    1adb458919e842cd78c72b1ff00e5e93cb6ef75e

    SHA256

    bea3f797921992fda45c19db41e10e3b325bcdd3ea35d35c1fa70535477ad9c1

    SHA512

    b63df3bad9272f45ba0f50e2c50aaed7a04eb1b000d5855d9f3a8e5c5f2d381c667b1e9c1e1f03f80584a7941a96992838664ae9dd25e1b8320e026da35b8223