Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2023 06:31
Static task
static1
Behavioral task
behavioral1
Sample
Dhl Authorisation 0471.js
Resource
win7-20230621-en
windows7-x64
Behavioral task
behavioral2
Sample
Dhl Authorisation 0471.js
Resource
win10v2004-20230621-en
windows10-2004-x64
General
-
Target
Dhl Authorisation 0471.js
-
Size
2.7MB
-
MD5
eed1ebe93897be063de0e58e4727e202
-
SHA1
81d8a907c8b0c7aea595f19214588d14f8d34922
-
SHA256
ee4d4c17bf09054c1f23e7a41363a788c77e604b72360543a47c140b25e9e100
-
SHA512
be4395746b1b02af6262d65669c0d6df5228b84e960ee7c2f6dc30ef6aff8c49150235ab0bf1f2e4067a9236b0d95eeddb189c4ba368fb6d4ad2a11a5a9aaf19
-
SSDEEP
24576:nqCxdnXs0pApmfJL/SoAWQLE6/WXpVxzrO/J/HWVZBmqdYnV0tme/4lFOi51o39D:B
Malware Config
Extracted
wshrat
http://80.85.154.247:5053
Signatures
-
Blocklisted process makes network request 61 IoCs
flow pid Process 11 3464 wscript.exe 12 2880 wscript.exe 13 5064 wscript.exe 15 2880 wscript.exe 16 3464 wscript.exe 17 5064 wscript.exe 18 2880 wscript.exe 19 2880 wscript.exe 22 3464 wscript.exe 25 5064 wscript.exe 32 2880 wscript.exe 35 2880 wscript.exe 38 3464 wscript.exe 41 5064 wscript.exe 42 2880 wscript.exe 43 2880 wscript.exe 44 3464 wscript.exe 45 5064 wscript.exe 46 2880 wscript.exe 47 3464 wscript.exe 48 5064 wscript.exe 49 2880 wscript.exe 52 2880 wscript.exe 54 3464 wscript.exe 55 5064 wscript.exe 56 2880 wscript.exe 57 2880 wscript.exe 58 3464 wscript.exe 59 5064 wscript.exe 60 2880 wscript.exe 61 2880 wscript.exe 62 3464 wscript.exe 63 5064 wscript.exe 66 2880 wscript.exe 67 2880 wscript.exe 68 3464 wscript.exe 69 5064 wscript.exe 70 2880 wscript.exe 71 3464 wscript.exe 72 5064 wscript.exe 73 2880 wscript.exe 74 2880 wscript.exe 75 3464 wscript.exe 76 5064 wscript.exe 77 2880 wscript.exe 78 2880 wscript.exe 79 3464 wscript.exe 80 5064 wscript.exe 81 2880 wscript.exe 82 2880 wscript.exe 83 3464 wscript.exe 84 5064 wscript.exe 85 2880 wscript.exe 86 2880 wscript.exe 87 3464 wscript.exe 88 5064 wscript.exe 89 2880 wscript.exe 90 3464 wscript.exe 91 5064 wscript.exe 92 2880 wscript.exe 93 2880 wscript.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dhl Authorisation 0471.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lOtnWPJMDG.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lOtnWPJMDG.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dhl Authorisation 0471.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lOtnWPJMDG.js wscript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dhl Authorisation 0471 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Dhl Authorisation 0471.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dhl Authorisation 0471 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Dhl Authorisation 0471.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dhl Authorisation 0471 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Dhl Authorisation 0471.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dhl Authorisation 0471 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Dhl Authorisation 0471.js\"" wscript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 29 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 42 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 43 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 60 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 19 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 82 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 92 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 46 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 66 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 70 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 73 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 85 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 89 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 56 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 49 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 81 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 86 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 15 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 18 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 32 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 35 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 52 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 57 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 77 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 12 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 67 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 74 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 61 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 93 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript HTTP User-Agent header 78 WSHRAT|DC4FC4A6|GAJYPACP|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 26/6/2023|JavaScript -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 372 wrote to memory of 3464 372 wscript.exe 85 PID 372 wrote to memory of 3464 372 wscript.exe 85 PID 372 wrote to memory of 2880 372 wscript.exe 86 PID 372 wrote to memory of 2880 372 wscript.exe 86 PID 2880 wrote to memory of 5064 2880 wscript.exe 87 PID 2880 wrote to memory of 5064 2880 wscript.exe 87
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Dhl Authorisation 0471.js"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\lOtnWPJMDG.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:3464
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Dhl Authorisation 0471.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\lOtnWPJMDG.js"3⤵
- Blocklisted process makes network request
- Drops startup file
PID:5064
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5eed1ebe93897be063de0e58e4727e202
SHA181d8a907c8b0c7aea595f19214588d14f8d34922
SHA256ee4d4c17bf09054c1f23e7a41363a788c77e604b72360543a47c140b25e9e100
SHA512be4395746b1b02af6262d65669c0d6df5228b84e960ee7c2f6dc30ef6aff8c49150235ab0bf1f2e4067a9236b0d95eeddb189c4ba368fb6d4ad2a11a5a9aaf19
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dhl Authorisation 0471.js
Filesize2.7MB
MD5eed1ebe93897be063de0e58e4727e202
SHA181d8a907c8b0c7aea595f19214588d14f8d34922
SHA256ee4d4c17bf09054c1f23e7a41363a788c77e604b72360543a47c140b25e9e100
SHA512be4395746b1b02af6262d65669c0d6df5228b84e960ee7c2f6dc30ef6aff8c49150235ab0bf1f2e4067a9236b0d95eeddb189c4ba368fb6d4ad2a11a5a9aaf19
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dhl Authorisation 0471.js
Filesize2.7MB
MD5eed1ebe93897be063de0e58e4727e202
SHA181d8a907c8b0c7aea595f19214588d14f8d34922
SHA256ee4d4c17bf09054c1f23e7a41363a788c77e604b72360543a47c140b25e9e100
SHA512be4395746b1b02af6262d65669c0d6df5228b84e960ee7c2f6dc30ef6aff8c49150235ab0bf1f2e4067a9236b0d95eeddb189c4ba368fb6d4ad2a11a5a9aaf19
-
Filesize
346KB
MD5cf607336b51230f951c58662b5a1f5ce
SHA14415bc64be744d850ab85645b125794e85febff8
SHA256b24957bc6b75d6b95b90e3dda12c8afe989a3a6b8e59dd418c0afc781267f202
SHA5125520b012a1aa77b7a5b69d925e60ecab26e3ad83230ec5deea0254b26493bb1a1c9b9fc2aa8e786f21470fd0f5cde57473379b0edbeaf6e5d40a79ae7b7ffba5
-
Filesize
346KB
MD5cf607336b51230f951c58662b5a1f5ce
SHA14415bc64be744d850ab85645b125794e85febff8
SHA256b24957bc6b75d6b95b90e3dda12c8afe989a3a6b8e59dd418c0afc781267f202
SHA5125520b012a1aa77b7a5b69d925e60ecab26e3ad83230ec5deea0254b26493bb1a1c9b9fc2aa8e786f21470fd0f5cde57473379b0edbeaf6e5d40a79ae7b7ffba5
-
Filesize
346KB
MD5cf607336b51230f951c58662b5a1f5ce
SHA14415bc64be744d850ab85645b125794e85febff8
SHA256b24957bc6b75d6b95b90e3dda12c8afe989a3a6b8e59dd418c0afc781267f202
SHA5125520b012a1aa77b7a5b69d925e60ecab26e3ad83230ec5deea0254b26493bb1a1c9b9fc2aa8e786f21470fd0f5cde57473379b0edbeaf6e5d40a79ae7b7ffba5