Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08-06-2023 17:48
Static task
static1
Behavioral task
behavioral1
Sample
ShippingDetails.js
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
ShippingDetails.js
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
ShippingDetails.js
-
Size
4.6MB
-
MD5
e8150ba03200183abce718f6b028b2c3
-
SHA1
606491a54f6dc244fc533317a0f936b818de9a4c
-
SHA256
3f3ee13d1a86d8f63c3c730556cfcff2a1f8d22980fdc001b5240ce7315dcd23
-
SHA512
4aa7fd5b696933155143f66a54785c48ff368bb6fbf7f5afcc24ababd2436c31b0d847f32b3d66888867f179a34dd9284a9c9a8f54f3f96ea23601804bafacb5
-
SSDEEP
24576:p5K1gGMDzG6PbjQ46Te9iEQokfhrC/SwzkfHGi9xM7LHyG9XqUrQdAtzkTGCJTrK:G3Fmv
Malware Config
Extracted
wshrat
http://139.177.146.165:4848
Signatures
-
Blocklisted process makes network request 54 IoCs
flow pid Process 6 1260 wscript.exe 9 364 wscript.exe 10 1288 wscript.exe 11 1288 wscript.exe 13 1260 wscript.exe 14 364 wscript.exe 16 1288 wscript.exe 19 1288 wscript.exe 23 364 wscript.exe 24 1260 wscript.exe 27 1288 wscript.exe 30 364 wscript.exe 31 1260 wscript.exe 33 1288 wscript.exe 35 1288 wscript.exe 37 1260 wscript.exe 38 364 wscript.exe 40 1288 wscript.exe 43 364 wscript.exe 44 1260 wscript.exe 45 1288 wscript.exe 50 1288 wscript.exe 52 1260 wscript.exe 53 364 wscript.exe 55 1288 wscript.exe 57 1288 wscript.exe 60 1260 wscript.exe 61 364 wscript.exe 63 1288 wscript.exe 66 364 wscript.exe 67 1260 wscript.exe 70 1288 wscript.exe 72 1288 wscript.exe 75 364 wscript.exe 77 1260 wscript.exe 78 1288 wscript.exe 81 364 wscript.exe 82 1260 wscript.exe 83 1288 wscript.exe 85 1288 wscript.exe 88 364 wscript.exe 90 1260 wscript.exe 93 1288 wscript.exe 95 1288 wscript.exe 98 364 wscript.exe 99 1260 wscript.exe 100 1288 wscript.exe 104 364 wscript.exe 105 1260 wscript.exe 107 1288 wscript.exe 109 1288 wscript.exe 111 364 wscript.exe 112 1260 wscript.exe 116 1288 wscript.exe -
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShippingDetails.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VQlpXNzQJz.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VQlpXNzQJz.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShippingDetails.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VQlpXNzQJz.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShippingDetails = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ShippingDetails.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShippingDetails = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ShippingDetails.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShippingDetails = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ShippingDetails.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShippingDetails = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ShippingDetails.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 24 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 27 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 50 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 63 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 70 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 109 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 85 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 93 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 95 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 19 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 45 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 57 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 78 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 83 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 10 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 16 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 55 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 72 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 100 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 116 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 11 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 33 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 35 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 40 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript HTTP User-Agent header 107 WSHRAT|106B36FF|HVMHZIYD|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 8/6/2023|JavaScript -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1260 1324 wscript.exe 28 PID 1324 wrote to memory of 1260 1324 wscript.exe 28 PID 1324 wrote to memory of 1260 1324 wscript.exe 28 PID 1324 wrote to memory of 1288 1324 wscript.exe 29 PID 1324 wrote to memory of 1288 1324 wscript.exe 29 PID 1324 wrote to memory of 1288 1324 wscript.exe 29 PID 1288 wrote to memory of 364 1288 wscript.exe 31 PID 1288 wrote to memory of 364 1288 wscript.exe 31 PID 1288 wrote to memory of 364 1288 wscript.exe 31
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ShippingDetails.js1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\VQlpXNzQJz.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:1260
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ShippingDetails.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\VQlpXNzQJz.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:364
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.6MB
MD5e8150ba03200183abce718f6b028b2c3
SHA1606491a54f6dc244fc533317a0f936b818de9a4c
SHA2563f3ee13d1a86d8f63c3c730556cfcff2a1f8d22980fdc001b5240ce7315dcd23
SHA5124aa7fd5b696933155143f66a54785c48ff368bb6fbf7f5afcc24ababd2436c31b0d847f32b3d66888867f179a34dd9284a9c9a8f54f3f96ea23601804bafacb5
-
Filesize
4.6MB
MD5e8150ba03200183abce718f6b028b2c3
SHA1606491a54f6dc244fc533317a0f936b818de9a4c
SHA2563f3ee13d1a86d8f63c3c730556cfcff2a1f8d22980fdc001b5240ce7315dcd23
SHA5124aa7fd5b696933155143f66a54785c48ff368bb6fbf7f5afcc24ababd2436c31b0d847f32b3d66888867f179a34dd9284a9c9a8f54f3f96ea23601804bafacb5
-
Filesize
346KB
MD53ed07b2cfc14457c448129ac338d1a9b
SHA1e07cd37475c0a9e2c53d4f7df317c8b4be70855e
SHA256ed505690251f92f79fb3341968a3283e69bcd4ffe08539593b1601fac515c36b
SHA512db34f63ad7cd4580c200040f1ced68ef7477cf61e44304932a2989cda520a56e90bf51d27bcd8474f14600a92f25664befa9a64caf26c009d5ecb6a610b78fa5
-
Filesize
4.6MB
MD5e8150ba03200183abce718f6b028b2c3
SHA1606491a54f6dc244fc533317a0f936b818de9a4c
SHA2563f3ee13d1a86d8f63c3c730556cfcff2a1f8d22980fdc001b5240ce7315dcd23
SHA5124aa7fd5b696933155143f66a54785c48ff368bb6fbf7f5afcc24ababd2436c31b0d847f32b3d66888867f179a34dd9284a9c9a8f54f3f96ea23601804bafacb5
-
Filesize
346KB
MD53ed07b2cfc14457c448129ac338d1a9b
SHA1e07cd37475c0a9e2c53d4f7df317c8b4be70855e
SHA256ed505690251f92f79fb3341968a3283e69bcd4ffe08539593b1601fac515c36b
SHA512db34f63ad7cd4580c200040f1ced68ef7477cf61e44304932a2989cda520a56e90bf51d27bcd8474f14600a92f25664befa9a64caf26c009d5ecb6a610b78fa5
-
Filesize
346KB
MD53ed07b2cfc14457c448129ac338d1a9b
SHA1e07cd37475c0a9e2c53d4f7df317c8b4be70855e
SHA256ed505690251f92f79fb3341968a3283e69bcd4ffe08539593b1601fac515c36b
SHA512db34f63ad7cd4580c200040f1ced68ef7477cf61e44304932a2989cda520a56e90bf51d27bcd8474f14600a92f25664befa9a64caf26c009d5ecb6a610b78fa5