Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2023 22:11
Static task
static1
Behavioral task
behavioral1
Sample
SoftbankNDA.js
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
SoftbankNDA.js
Resource
win10v2004-20230831-en
General
-
Target
SoftbankNDA.js
-
Size
21KB
-
MD5
c8f19fa9f346f7409e3bba98c1e3f058
-
SHA1
d857192d59c0ce2196925ce59436e0e36d94b6ee
-
SHA256
645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808
-
SHA512
cf214cd1c41ee8b42e1f1ea55d61802a1f35d89626406e02bed1874dfae15ccd24629c7ec2bf0686131691fdd8efefd4d91833afad6c3976fb908c69c4f2f326
-
SSDEEP
384:n/+tc8v+YhrKZKZXeX5U7CP9fD0eX5GrnB63vQOaSDsvkysjqFJ8TatW8TaUxTam:n/+tbv+YhdZXeXic9fD0eXknB6Y6Dsv7
Malware Config
Extracted
wshrat
http://homesafe1000.duckdns.org:1604
Signatures
-
Blocklisted process makes network request 30 IoCs
flow pid Process 18 2096 wscript.exe 47 2096 wscript.exe 48 2096 wscript.exe 59 2096 wscript.exe 60 2096 wscript.exe 61 2096 wscript.exe 71 2096 wscript.exe 76 2096 wscript.exe 77 2096 wscript.exe 78 2096 wscript.exe 79 2096 wscript.exe 80 2096 wscript.exe 81 2096 wscript.exe 82 2096 wscript.exe 83 2096 wscript.exe 84 2096 wscript.exe 85 2096 wscript.exe 86 2096 wscript.exe 87 2096 wscript.exe 88 2096 wscript.exe 89 2096 wscript.exe 90 2096 wscript.exe 91 2096 wscript.exe 92 2096 wscript.exe 93 2096 wscript.exe 96 2096 wscript.exe 98 2096 wscript.exe 99 2096 wscript.exe 100 2096 wscript.exe 101 2096 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SoftbankNDA.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SoftbankNDA.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SoftbankNDA = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SoftbankNDA.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SoftbankNDA = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SoftbankNDA.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SoftbankNDA = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SoftbankNDA.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SoftbankNDA = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\SoftbankNDA.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 30 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 82 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 88 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 84 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 91 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 92 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 93 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 18 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 71 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 80 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 87 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 59 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 61 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 81 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 98 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 101 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 60 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 76 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 83 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 79 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 96 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 99 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 90 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 77 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 78 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 86 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 89 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 100 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 47 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 48 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript HTTP User-Agent header 85 WSHRAT|AA342AE5|NVYNMMTR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 12/9/2023|JavaScript -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2096 1044 wscript.exe 85 PID 1044 wrote to memory of 2096 1044 wscript.exe 85
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\SoftbankNDA.js1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\SoftbankNDA.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5c8f19fa9f346f7409e3bba98c1e3f058
SHA1d857192d59c0ce2196925ce59436e0e36d94b6ee
SHA256645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808
SHA512cf214cd1c41ee8b42e1f1ea55d61802a1f35d89626406e02bed1874dfae15ccd24629c7ec2bf0686131691fdd8efefd4d91833afad6c3976fb908c69c4f2f326
-
Filesize
21KB
MD5c8f19fa9f346f7409e3bba98c1e3f058
SHA1d857192d59c0ce2196925ce59436e0e36d94b6ee
SHA256645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808
SHA512cf214cd1c41ee8b42e1f1ea55d61802a1f35d89626406e02bed1874dfae15ccd24629c7ec2bf0686131691fdd8efefd4d91833afad6c3976fb908c69c4f2f326
-
Filesize
21KB
MD5c8f19fa9f346f7409e3bba98c1e3f058
SHA1d857192d59c0ce2196925ce59436e0e36d94b6ee
SHA256645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808
SHA512cf214cd1c41ee8b42e1f1ea55d61802a1f35d89626406e02bed1874dfae15ccd24629c7ec2bf0686131691fdd8efefd4d91833afad6c3976fb908c69c4f2f326