Analysis
- max time kernel
147s - max time network
151s - platform
windows7_x64 - resource
win7-20230703-en - resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system - submitted
12/07/2023, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
Request For Quotation.js
Resource
win7-20230703-en
windows7-x64
7 signatures
150 seconds
General
- Target Request For Quotation.js
- Size 965KB
- Sample230712-ntbjcada34
- SHA256 bf2f0ecbbbd33ef1369595b5f7455e8777abeadd3b12571209a8f44c92628ee8
- MD5 361ff80872705750749fc5c27006aba5
- SHA1 d0e36f27aea4f6b17587f68d06f307e368d8443a
- SHA512 ee33aa8a50b7f30925a44f22bfe7be6e686ce4fdeb49d9e258b0b5a3c16b94568723dfca53ba80bdc12be4a8ae3eee455a1322c75d094c886174d89052415b4f
- SSDEEP 6144:QQQ2zF22es2/0w7aMT3H2KqPLOSxgEDC4OlNnOm5trZ+DGArhisPGfLA5b0l2uvN:TfG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
wshrat
C2
-
http://harold.2waky.com:3609
Signatures
- Blocklisted process makes network request 16 IoCs
flow pid Process 4 2448 wscript.exe 6 2448 wscript.exe 7 2448 wscript.exe 8 2448 wscript.exe 11 2448 wscript.exe 12 2448 wscript.exe 13 2448 wscript.exe 15 2448 wscript.exe 16 2448 wscript.exe 17 2448 wscript.exe 19 2448 wscript.exe 20 2448 wscript.exe 21 2448 wscript.exe 23 2448 wscript.exe 24 2448 wscript.exe 25 2448 wscript.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js wscript.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Script User-Agent 15 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 20 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 7 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 17 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 25 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 13 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 15 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 21 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 24 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 11 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 12 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 16 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 19 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 23 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 6 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 8 WSHRAT|88BB5D50|RXPFQWTW|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 12/7/2023|JavaScript-v3.4|NL:Netherlands - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1144 wrote to memory of 2448 1144 wscript.exe 30 PID 1144 wrote to memory of 2448 1144 wscript.exe 30 PID 1144 wrote to memory of 2448 1144 wscript.exe 30
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Request For Quotation.js"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Request For Quotation.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:2448
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js
- Size 965KB
- SHA256 bf2f0ecbbbd33ef1369595b5f7455e8777abeadd3b12571209a8f44c92628ee8
- MD5 361ff80872705750749fc5c27006aba5
- SHA1 d0e36f27aea4f6b17587f68d06f307e368d8443a
- SHA512 ee33aa8a50b7f30925a44f22bfe7be6e686ce4fdeb49d9e258b0b5a3c16b94568723dfca53ba80bdc12be4a8ae3eee455a1322c75d094c886174d89052415b4f
- SSDEEP 6144:QQQ2zF22es2/0w7aMT3H2KqPLOSxgEDC4OlNnOm5trZ+DGArhisPGfLA5b0l2uvN:TfG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js
- Size 965KB
- SHA256 bf2f0ecbbbd33ef1369595b5f7455e8777abeadd3b12571209a8f44c92628ee8
- MD5 361ff80872705750749fc5c27006aba5
- SHA1 d0e36f27aea4f6b17587f68d06f307e368d8443a
- SHA512 ee33aa8a50b7f30925a44f22bfe7be6e686ce4fdeb49d9e258b0b5a3c16b94568723dfca53ba80bdc12be4a8ae3eee455a1322c75d094c886174d89052415b4f
- SSDEEP 6144:QQQ2zF22es2/0w7aMT3H2KqPLOSxgEDC4OlNnOm5trZ+DGArhisPGfLA5b0l2uvN:TfG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Request For Quotation.js
- Size 965KB
- SHA256 bf2f0ecbbbd33ef1369595b5f7455e8777abeadd3b12571209a8f44c92628ee8
- MD5 361ff80872705750749fc5c27006aba5
- SHA1 d0e36f27aea4f6b17587f68d06f307e368d8443a
- SHA512 ee33aa8a50b7f30925a44f22bfe7be6e686ce4fdeb49d9e258b0b5a3c16b94568723dfca53ba80bdc12be4a8ae3eee455a1322c75d094c886174d89052415b4f
- SSDEEP 6144:QQQ2zF22es2/0w7aMT3H2KqPLOSxgEDC4OlNnOm5trZ+DGArhisPGfLA5b0l2uvN:TfG
- MD5 SHA1 SHA512 SSDEEP