Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
26-06-2023 06:31
Static task
static1
Behavioral task
behavioral1
Sample
Dhl Authorisation 0471.js
Resource
win7-20230621-en
windows7-x64
Behavioral task
behavioral2
Sample
Dhl Authorisation 0471.js
Resource
win10v2004-20230621-en
windows10-2004-x64
General
-
Target
Dhl Authorisation 0471.js
-
Size
2.7MB
-
MD5
eed1ebe93897be063de0e58e4727e202
-
SHA1
81d8a907c8b0c7aea595f19214588d14f8d34922
-
SHA256
ee4d4c17bf09054c1f23e7a41363a788c77e604b72360543a47c140b25e9e100
-
SHA512
be4395746b1b02af6262d65669c0d6df5228b84e960ee7c2f6dc30ef6aff8c49150235ab0bf1f2e4067a9236b0d95eeddb189c4ba368fb6d4ad2a11a5a9aaf19
-
SSDEEP
24576:nqCxdnXs0pApmfJL/SoAWQLE6/WXpVxzrO/J/HWVZBmqdYnV0tme/4lFOi51o39D:B
Malware Config
Extracted
wshrat
http://80.85.154.247:5053
Signatures
-
Blocklisted process makes network request 57 IoCs
flow pid Process 9 932 wscript.exe 10 1100 wscript.exe 11 1472 wscript.exe 13 1472 wscript.exe 14 1100 wscript.exe 16 932 wscript.exe 17 1472 wscript.exe 20 1472 wscript.exe 22 1100 wscript.exe 24 932 wscript.exe 28 1472 wscript.exe 30 1100 wscript.exe 31 932 wscript.exe 34 1472 wscript.exe 37 1472 wscript.exe 38 1100 wscript.exe 40 932 wscript.exe 41 1472 wscript.exe 43 1100 wscript.exe 45 1472 wscript.exe 47 932 wscript.exe 51 1472 wscript.exe 53 1100 wscript.exe 55 932 wscript.exe 57 1472 wscript.exe 59 1472 wscript.exe 60 1100 wscript.exe 63 932 wscript.exe 64 1472 wscript.exe 66 1100 wscript.exe 67 932 wscript.exe 70 1472 wscript.exe 74 1472 wscript.exe 76 1100 wscript.exe 77 932 wscript.exe 79 1472 wscript.exe 81 1100 wscript.exe 83 932 wscript.exe 85 1472 wscript.exe 87 1472 wscript.exe 89 1100 wscript.exe 90 932 wscript.exe 94 1472 wscript.exe 96 1472 wscript.exe 99 932 wscript.exe 100 1100 wscript.exe 102 1472 wscript.exe 105 932 wscript.exe 106 1100 wscript.exe 107 1472 wscript.exe 109 1472 wscript.exe 112 932 wscript.exe 113 1100 wscript.exe 116 1472 wscript.exe 119 1100 wscript.exe 120 1472 wscript.exe 122 932 wscript.exe -
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dhl Authorisation 0471.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lOtnWPJMDG.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lOtnWPJMDG.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dhl Authorisation 0471.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lOtnWPJMDG.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dhl Authorisation 0471 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Dhl Authorisation 0471.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dhl Authorisation 0471 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Dhl Authorisation 0471.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dhl Authorisation 0471 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Dhl Authorisation 0471.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dhl Authorisation 0471 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Dhl Authorisation 0471.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 25 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 85 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 87 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 107 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 116 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 41 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 45 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 70 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 94 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 109 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 120 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 17 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 51 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 37 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 57 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 59 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 64 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 96 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 13 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 28 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 34 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 74 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 79 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 102 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 11 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 20 WSHRAT|94AB1E66|NNDGNFRP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 26/6/2023|JavaScript -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1100 1716 wscript.exe 27 PID 1716 wrote to memory of 1100 1716 wscript.exe 27 PID 1716 wrote to memory of 1100 1716 wscript.exe 27 PID 1716 wrote to memory of 1472 1716 wscript.exe 28 PID 1716 wrote to memory of 1472 1716 wscript.exe 28 PID 1716 wrote to memory of 1472 1716 wscript.exe 28 PID 1472 wrote to memory of 932 1472 wscript.exe 30 PID 1472 wrote to memory of 932 1472 wscript.exe 30 PID 1472 wrote to memory of 932 1472 wscript.exe 30
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Dhl Authorisation 0471.js"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\lOtnWPJMDG.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:1100
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Dhl Authorisation 0471.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\lOtnWPJMDG.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:932
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5eed1ebe93897be063de0e58e4727e202
SHA181d8a907c8b0c7aea595f19214588d14f8d34922
SHA256ee4d4c17bf09054c1f23e7a41363a788c77e604b72360543a47c140b25e9e100
SHA512be4395746b1b02af6262d65669c0d6df5228b84e960ee7c2f6dc30ef6aff8c49150235ab0bf1f2e4067a9236b0d95eeddb189c4ba368fb6d4ad2a11a5a9aaf19
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dhl Authorisation 0471.js
Filesize2.7MB
MD5eed1ebe93897be063de0e58e4727e202
SHA181d8a907c8b0c7aea595f19214588d14f8d34922
SHA256ee4d4c17bf09054c1f23e7a41363a788c77e604b72360543a47c140b25e9e100
SHA512be4395746b1b02af6262d65669c0d6df5228b84e960ee7c2f6dc30ef6aff8c49150235ab0bf1f2e4067a9236b0d95eeddb189c4ba368fb6d4ad2a11a5a9aaf19
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dhl Authorisation 0471.js
Filesize2.7MB
MD5eed1ebe93897be063de0e58e4727e202
SHA181d8a907c8b0c7aea595f19214588d14f8d34922
SHA256ee4d4c17bf09054c1f23e7a41363a788c77e604b72360543a47c140b25e9e100
SHA512be4395746b1b02af6262d65669c0d6df5228b84e960ee7c2f6dc30ef6aff8c49150235ab0bf1f2e4067a9236b0d95eeddb189c4ba368fb6d4ad2a11a5a9aaf19
-
Filesize
346KB
MD5cf607336b51230f951c58662b5a1f5ce
SHA14415bc64be744d850ab85645b125794e85febff8
SHA256b24957bc6b75d6b95b90e3dda12c8afe989a3a6b8e59dd418c0afc781267f202
SHA5125520b012a1aa77b7a5b69d925e60ecab26e3ad83230ec5deea0254b26493bb1a1c9b9fc2aa8e786f21470fd0f5cde57473379b0edbeaf6e5d40a79ae7b7ffba5
-
Filesize
346KB
MD5cf607336b51230f951c58662b5a1f5ce
SHA14415bc64be744d850ab85645b125794e85febff8
SHA256b24957bc6b75d6b95b90e3dda12c8afe989a3a6b8e59dd418c0afc781267f202
SHA5125520b012a1aa77b7a5b69d925e60ecab26e3ad83230ec5deea0254b26493bb1a1c9b9fc2aa8e786f21470fd0f5cde57473379b0edbeaf6e5d40a79ae7b7ffba5
-
Filesize
346KB
MD5cf607336b51230f951c58662b5a1f5ce
SHA14415bc64be744d850ab85645b125794e85febff8
SHA256b24957bc6b75d6b95b90e3dda12c8afe989a3a6b8e59dd418c0afc781267f202
SHA5125520b012a1aa77b7a5b69d925e60ecab26e3ad83230ec5deea0254b26493bb1a1c9b9fc2aa8e786f21470fd0f5cde57473379b0edbeaf6e5d40a79ae7b7ffba5