Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2023, 13:25
Static task
static1
Behavioral task
behavioral1
Sample
645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js
Resource
win10v2004-20230831-en
General
-
Target
645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js
-
Size
21KB
-
MD5
c8f19fa9f346f7409e3bba98c1e3f058
-
SHA1
d857192d59c0ce2196925ce59436e0e36d94b6ee
-
SHA256
645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808
-
SHA512
cf214cd1c41ee8b42e1f1ea55d61802a1f35d89626406e02bed1874dfae15ccd24629c7ec2bf0686131691fdd8efefd4d91833afad6c3976fb908c69c4f2f326
-
SSDEEP
384:n/+tc8v+YhrKZKZXeX5U7CP9fD0eX5GrnB63vQOaSDsvkysjqFJ8TatW8TaUxTam:n/+tbv+YhdZXeXic9fD0eXknB6Y6Dsv7
Malware Config
Extracted
wshrat
http://homesafe1000.duckdns.org:1604
Signatures
-
Blocklisted process makes network request 30 IoCs
flow pid Process 13 2944 wscript.exe 37 2944 wscript.exe 38 2944 wscript.exe 48 2944 wscript.exe 49 2944 wscript.exe 50 2944 wscript.exe 60 2944 wscript.exe 65 2944 wscript.exe 66 2944 wscript.exe 67 2944 wscript.exe 68 2944 wscript.exe 69 2944 wscript.exe 70 2944 wscript.exe 71 2944 wscript.exe 72 2944 wscript.exe 73 2944 wscript.exe 74 2944 wscript.exe 75 2944 wscript.exe 76 2944 wscript.exe 77 2944 wscript.exe 78 2944 wscript.exe 79 2944 wscript.exe 80 2944 wscript.exe 81 2944 wscript.exe 82 2944 wscript.exe 83 2944 wscript.exe 84 2944 wscript.exe 85 2944 wscript.exe 89 2944 wscript.exe 90 2944 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js wscript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js\"" wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 30 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 84 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 67 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 73 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 66 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 75 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 89 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 48 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 49 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 78 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 80 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 81 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 38 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 70 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 83 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 37 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 74 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 76 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 85 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 90 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 50 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 72 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 68 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 71 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 77 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 79 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 13 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 65 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 82 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 60 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript HTTP User-Agent header 69 WSHRAT|8466D814|VNIYNTNL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 13/9/2023|JavaScript -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3768 wrote to memory of 2944 3768 wscript.exe 87 PID 3768 wrote to memory of 2944 3768 wscript.exe 87
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js
Filesize21KB
MD5c8f19fa9f346f7409e3bba98c1e3f058
SHA1d857192d59c0ce2196925ce59436e0e36d94b6ee
SHA256645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808
SHA512cf214cd1c41ee8b42e1f1ea55d61802a1f35d89626406e02bed1874dfae15ccd24629c7ec2bf0686131691fdd8efefd4d91833afad6c3976fb908c69c4f2f326
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js
Filesize21KB
MD5c8f19fa9f346f7409e3bba98c1e3f058
SHA1d857192d59c0ce2196925ce59436e0e36d94b6ee
SHA256645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808
SHA512cf214cd1c41ee8b42e1f1ea55d61802a1f35d89626406e02bed1874dfae15ccd24629c7ec2bf0686131691fdd8efefd4d91833afad6c3976fb908c69c4f2f326
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808_JC.js
Filesize21KB
MD5c8f19fa9f346f7409e3bba98c1e3f058
SHA1d857192d59c0ce2196925ce59436e0e36d94b6ee
SHA256645074638e8c896237a2340918cb99558103c717bbcb20a483651e6e242c5808
SHA512cf214cd1c41ee8b42e1f1ea55d61802a1f35d89626406e02bed1874dfae15ccd24629c7ec2bf0686131691fdd8efefd4d91833afad6c3976fb908c69c4f2f326