Analysis
- max time kernel
135s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
01/06/2023, 14:55
General
- Target Request For Quotation.js
- Size 1.0MB
- Sample230601-saffeaeg88
- SHA256 8f7d98aa6507d36a55f21687746b93034dd00c2e5a0c8af19dc3815b324fa194
Score
10/10
Malware Config
Extracted
Family
-
wshrat
C2
-
http://harold.2waky.com:3609
Signatures
- WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
- Blocklisted process makes network request 8 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Script User-Agent 6 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Request For Quotation.js"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Request For Quotation.js"2⤵
- Blocklisted process makes network request
- Drops startup file
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Request For Quotation.js
Request For Quotation.js
Request For Quotation.js