Analysis
-
max time kernel
132s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-06-2023 14:55
Static task
static1
Behavioral task
behavioral1
Sample
Request For Quotation.js
Resource
win7-20230220-en
General
-
Target
Request For Quotation.js
-
Size
926KB
-
MD5
e1fce1614b7ce17de7b7de01ebcbf1a9
-
SHA1
83ca60f9e8e25437881338b8af9f8136b4925980
-
SHA256
af8168e035939256e97650454e425e61c561576570f82bc440327a2347d8966a
-
SHA512
6b9ba0e52ca0247d85aed3f3f4e00b294e595ddcb118992dc4cb315513dbb50188d7064a044b329b029929ddb5c1da7500a30de23a1d3e0de35385b4950bf66d
-
SSDEEP
6144:QQPrN4dEtorFCPqFnJKw1KYWn8b69Va0qP2XEhvv0QQpv+HtXoQZybO2slkTZJ3b:TuWUrA
Malware Config
Extracted
wshrat
http://harold.2waky.com:3609
Signatures
-
Blocklisted process makes network request 7 IoCs
Processes:
wscript.exeflow pid process 4 1352 wscript.exe 6 1352 wscript.exe 8 1352 wscript.exe 9 1352 wscript.exe 11 1352 wscript.exe 12 1352 wscript.exe 13 1352 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exewscript.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 9 WSHRAT|945C4F3A|THEQWNRW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/6/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 12 WSHRAT|945C4F3A|THEQWNRW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/6/2023|JavaScript-v3.4|IN:India HTTP User-Agent header 13 WSHRAT|945C4F3A|THEQWNRW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/6/2023|JavaScript-v3.4|IN:India -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1732 wrote to memory of 1352 1732 wscript.exe wscript.exe PID 1732 wrote to memory of 1352 1732 wscript.exe wscript.exe PID 1732 wrote to memory of 1352 1732 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Request For Quotation.js"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Request For Quotation.js"2⤵
- Blocklisted process makes network request
- Drops startup file
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.jsFilesize
926KB
MD5e1fce1614b7ce17de7b7de01ebcbf1a9
SHA183ca60f9e8e25437881338b8af9f8136b4925980
SHA256af8168e035939256e97650454e425e61c561576570f82bc440327a2347d8966a
SHA5126b9ba0e52ca0247d85aed3f3f4e00b294e595ddcb118992dc4cb315513dbb50188d7064a044b329b029929ddb5c1da7500a30de23a1d3e0de35385b4950bf66d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.jsFilesize
926KB
MD5e1fce1614b7ce17de7b7de01ebcbf1a9
SHA183ca60f9e8e25437881338b8af9f8136b4925980
SHA256af8168e035939256e97650454e425e61c561576570f82bc440327a2347d8966a
SHA5126b9ba0e52ca0247d85aed3f3f4e00b294e595ddcb118992dc4cb315513dbb50188d7064a044b329b029929ddb5c1da7500a30de23a1d3e0de35385b4950bf66d
-
C:\Users\Admin\AppData\Roaming\Request For Quotation.jsFilesize
926KB
MD5e1fce1614b7ce17de7b7de01ebcbf1a9
SHA183ca60f9e8e25437881338b8af9f8136b4925980
SHA256af8168e035939256e97650454e425e61c561576570f82bc440327a2347d8966a
SHA5126b9ba0e52ca0247d85aed3f3f4e00b294e595ddcb118992dc4cb315513dbb50188d7064a044b329b029929ddb5c1da7500a30de23a1d3e0de35385b4950bf66d