Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2023 07:45
Static task
static1
Behavioral task
behavioral1
Sample
ORDER-232903AF.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ORDER-232903AF.js
Resource
win10v2004-20230220-en
General
-
Target
ORDER-232903AF.js
-
Size
7KB
-
MD5
81d99b2657f3dc270466fbb9c2958a7c
-
SHA1
3c9541b0105664413b9ef3c8f9d13210443a43de
-
SHA256
62dbe0f60858cf1d24dc2dd808b35d843f35e7456889323ce4b648cb15446d72
-
SHA512
c0c4d057aa8fe52027e670d82d5d9a0b26d3fc3c008b5a1bdd87ac95975fb95ac229ee909d2b3190d027ca74676149bbfe0a3601ddd986b73ed18744d7517cd0
-
SSDEEP
24:hIErb05LU35YrOR/JM907TIy8+5UwLU5sVOv45w+v5CrNTtSr6m5pJx2:K4w5xBKdGdgUyre
Malware Config
Extracted
wshrat
http://chongmei33.publicvm.com:7045
Signatures
-
Blocklisted process makes network request 24 IoCs
flow pid Process 4 1756 wscript.exe 5 1756 wscript.exe 7 1756 wscript.exe 10 1756 wscript.exe 28 4088 WScript.exe 30 4088 WScript.exe 38 4088 WScript.exe 43 4088 WScript.exe 47 4088 WScript.exe 54 4088 WScript.exe 55 4088 WScript.exe 58 4088 WScript.exe 59 4088 WScript.exe 60 4088 WScript.exe 71 4088 WScript.exe 72 4088 WScript.exe 73 4088 WScript.exe 74 4088 WScript.exe 75 4088 WScript.exe 76 4088 WScript.exe 77 4088 WScript.exe 78 4088 WScript.exe 79 4088 WScript.exe 80 4088 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BFFFQN.vbs WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BFFFQN.vbs WScript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BFFFQN = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\BFFFQN.vbs\"" WScript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BFFFQN = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\BFFFQN.vbs\"" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings wscript.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1756 wrote to memory of 4088 1756 wscript.exe 83 PID 1756 wrote to memory of 4088 1756 wscript.exe 83
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ORDER-232903AF.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BFFFQN.vbs"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4088
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD59e6396c0f6372ad9dabf49ac46c37b19
SHA1532916ba3e0eb3e75bba96e46c10f28732f800cc
SHA256cde3243e5d239396688c6a7bac14a6baf46e60a242fe4788c063ccb3bf0a0e49
SHA5128fed54f8f61bf40f65689838782b59e4240f644841cf1f3667cf95789c75430c2143cc913493188d948e9c3a441251b702583380a80b9096904c91997c40a95f
-
Filesize
238KB
MD59e6396c0f6372ad9dabf49ac46c37b19
SHA1532916ba3e0eb3e75bba96e46c10f28732f800cc
SHA256cde3243e5d239396688c6a7bac14a6baf46e60a242fe4788c063ccb3bf0a0e49
SHA5128fed54f8f61bf40f65689838782b59e4240f644841cf1f3667cf95789c75430c2143cc913493188d948e9c3a441251b702583380a80b9096904c91997c40a95f