Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
Tax Returns of R58,765.js
Resource
win7-20230712-en
General
-
Target
Tax Returns of R58,765.js
-
Size
1.0MB
-
MD5
33300fb747c6677625aa17d03e1010f3
-
SHA1
b1bea456907b59a8182a0f01cc0e90f6e32e2779
-
SHA256
cbe7d5663fd5359a72f88e44d083703d9625235929c31e0f5b16a0b42cb44d35
-
SHA512
3c7af332da0a394354b0f3245a7677149ea63bdb5e6b5fcbd7fe984d338c1cecb7e299e127859c1dafc4bf199d3d8c3923d2c32213ab292ccc7aa42558b65764
-
SSDEEP
6144:QQ7vErztQ9MZIUWrltWZV1+VJaMd5KVPb5emOJ62+ILfahP2CTLqO0EXZ9gsP7Ay:Te
Malware Config
Extracted
wshrat
http://harold.2waky.com:3609
Signatures
-
Blocklisted process makes network request 13 IoCs
flow pid Process 18 3380 wscript.exe 20 3380 wscript.exe 28 3380 wscript.exe 44 3380 wscript.exe 45 3380 wscript.exe 46 3380 wscript.exe 54 3380 wscript.exe 66 3380 wscript.exe 67 3380 wscript.exe 71 3380 wscript.exe 72 3380 wscript.exe 77 3380 wscript.exe 78 3380 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns of R58,765.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns of R58,765.js wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 12 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 20 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 45 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 67 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 71 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 28 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 44 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 46 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 54 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 66 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 72 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 77 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands HTTP User-Agent header 78 WSHRAT|B000C75D|LMMMEQUO|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 19/7/2023|JavaScript-v3.4|NL:Netherlands -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2332 wrote to memory of 3380 2332 wscript.exe 86 PID 2332 wrote to memory of 3380 2332 wscript.exe 86
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Tax Returns of R58,765.js"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Tax Returns of R58,765.js"2⤵
- Blocklisted process makes network request
- Drops startup file
PID:3380
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns of R58,765.js
Filesize1.0MB
MD533300fb747c6677625aa17d03e1010f3
SHA1b1bea456907b59a8182a0f01cc0e90f6e32e2779
SHA256cbe7d5663fd5359a72f88e44d083703d9625235929c31e0f5b16a0b42cb44d35
SHA5123c7af332da0a394354b0f3245a7677149ea63bdb5e6b5fcbd7fe984d338c1cecb7e299e127859c1dafc4bf199d3d8c3923d2c32213ab292ccc7aa42558b65764
-
Filesize
1.0MB
MD533300fb747c6677625aa17d03e1010f3
SHA1b1bea456907b59a8182a0f01cc0e90f6e32e2779
SHA256cbe7d5663fd5359a72f88e44d083703d9625235929c31e0f5b16a0b42cb44d35
SHA5123c7af332da0a394354b0f3245a7677149ea63bdb5e6b5fcbd7fe984d338c1cecb7e299e127859c1dafc4bf199d3d8c3923d2c32213ab292ccc7aa42558b65764