Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2023 08:50
Static task
static1
Behavioral task
behavioral1
Sample
05212023840.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
05212023840.js
Resource
win10v2004-20230220-en
General
-
Target
05212023840.js
-
Size
1.0MB
-
MD5
9ccea994750b4d63ec5ef4a705f4855e
-
SHA1
334b5f78ce8d2a73fdb551acd389991552c39b3b
-
SHA256
b32f3e7d67e21bf2d40dec620a6f2a1b471847af427f924ed28b72633b9b6c40
-
SHA512
736c4ad5122bf6da2cb3adedebeea007f39f707b661f651114ea08cf33521c916e1a802701f4ea1e71767e78f913ddd0b01cfeb97b407a8a2b20d2e4c6f5079c
-
SSDEEP
3072:Cm0EaAcTqGaSqBHJZieEDQjb98Ztp8i8Jkzh:Cm0EaAcTqGaSqBHJZutUGzh
Malware Config
Extracted
wshrat
http://45.90.222.125:7121
Signatures
-
Blocklisted process makes network request 16 IoCs
Processes:
wscript.exewscript.exeflow pid process 2 1208 wscript.exe 5 1208 wscript.exe 6 2008 wscript.exe 11 2008 wscript.exe 12 2008 wscript.exe 13 2008 wscript.exe 16 2008 wscript.exe 17 2008 wscript.exe 19 2008 wscript.exe 20 2008 wscript.exe 21 2008 wscript.exe 23 2008 wscript.exe 24 2008 wscript.exe 25 2008 wscript.exe 27 2008 wscript.exe 28 2008 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05212023840.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05212023840.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
wscript.exewscript.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\05212023840 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\05212023840.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows\CurrentVersion\Run\05212023840 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\05212023840.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\05212023840 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\05212023840.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows\CurrentVersion\Run\05212023840 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\05212023840.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 12 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 28 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 22/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 22/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 27 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 22/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 19 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 22/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 20 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 22/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 21 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 22/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 23 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 22/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 25 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 22/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 5 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 12 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 22/5/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 17 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 22/5/2023|JavaScript-v3.4|IN:India -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1208 wrote to memory of 2008 1208 wscript.exe wscript.exe PID 1208 wrote to memory of 2008 1208 wscript.exe wscript.exe PID 1208 wrote to memory of 2008 1208 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\05212023840.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\05212023840.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\05212023840.jsFilesize
1.0MB
MD59ccea994750b4d63ec5ef4a705f4855e
SHA1334b5f78ce8d2a73fdb551acd389991552c39b3b
SHA256b32f3e7d67e21bf2d40dec620a6f2a1b471847af427f924ed28b72633b9b6c40
SHA512736c4ad5122bf6da2cb3adedebeea007f39f707b661f651114ea08cf33521c916e1a802701f4ea1e71767e78f913ddd0b01cfeb97b407a8a2b20d2e4c6f5079c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05212023840.jsMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05212023840.jsFilesize
1.0MB
MD59ccea994750b4d63ec5ef4a705f4855e
SHA1334b5f78ce8d2a73fdb551acd389991552c39b3b
SHA256b32f3e7d67e21bf2d40dec620a6f2a1b471847af427f924ed28b72633b9b6c40
SHA512736c4ad5122bf6da2cb3adedebeea007f39f707b661f651114ea08cf33521c916e1a802701f4ea1e71767e78f913ddd0b01cfeb97b407a8a2b20d2e4c6f5079c