Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2023, 16:56

General

  • Target

    Invoice.js

  • Size

    21KB

  • MD5

    12b2471d3c8dd16efd69ab5aca0678b9

  • SHA1

    15dca12d5e2d7d0281990ee43ffbcd22396fe01a

  • SHA256

    ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15

  • SHA512

    7f72edfe2fa615279bfb18a6117afdac855ea6c37250b2473dad2f9ee6d701869123240f44d631020b4fb727869d00a697de5ed7c7bd59640594b57a4db787ac

  • SSDEEP

    384:6/+tc8v+YhrKZKZXeX5U7CP9fD0eX5GrnB63vQOaSDsvkysjqFJ8TatW8TaUxTam:6/+tbv+YhdZXeXic9fD0eXknB6Y6Dsv7

Malware Config

Extracted

Family

wshrat

C2

http://wishpeople.duckdns.org:9071

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

  • Blocklisted process makes network request 18 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 18 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Invoice.js
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Invoice.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:1860
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:4812
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1672

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

      Filesize

      16KB

      MD5

      b4958eaaadde9e85cf1b1acae299494a

      SHA1

      7c17846d10ebeade6a908551a40b86ad81c58b6b

      SHA256

      12c07204d79fba4f4ae043fb776965a7407f58ef14f1a95e02dc42579e247c1a

      SHA512

      7c35c88b0e36ab30979f6d734aa3bac8f24247b03f8f4148f75269bda267621a993911520ea6ad7965032ab3109052549d725188e2539b13e3e6078413ed4bab

    • C:\Users\Admin\AppData\Roaming\Invoice.js

      Filesize

      21KB

      MD5

      12b2471d3c8dd16efd69ab5aca0678b9

      SHA1

      15dca12d5e2d7d0281990ee43ffbcd22396fe01a

      SHA256

      ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15

      SHA512

      7f72edfe2fa615279bfb18a6117afdac855ea6c37250b2473dad2f9ee6d701869123240f44d631020b4fb727869d00a697de5ed7c7bd59640594b57a4db787ac

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Invoice.js

      Filesize

      21KB

      MD5

      12b2471d3c8dd16efd69ab5aca0678b9

      SHA1

      15dca12d5e2d7d0281990ee43ffbcd22396fe01a

      SHA256

      ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15

      SHA512

      7f72edfe2fa615279bfb18a6117afdac855ea6c37250b2473dad2f9ee6d701869123240f44d631020b4fb727869d00a697de5ed7c7bd59640594b57a4db787ac

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Invoice.js

      Filesize

      21KB

      MD5

      12b2471d3c8dd16efd69ab5aca0678b9

      SHA1

      15dca12d5e2d7d0281990ee43ffbcd22396fe01a

      SHA256

      ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15

      SHA512

      7f72edfe2fa615279bfb18a6117afdac855ea6c37250b2473dad2f9ee6d701869123240f44d631020b4fb727869d00a697de5ed7c7bd59640594b57a4db787ac

    • memory/1672-47-0x000002480CD40000-0x000002480CD41000-memory.dmp

      Filesize

      4KB

    • memory/1672-50-0x000002480CD40000-0x000002480CD41000-memory.dmp

      Filesize

      4KB

    • memory/1672-41-0x000002480CD40000-0x000002480CD41000-memory.dmp

      Filesize

      4KB

    • memory/1672-42-0x000002480CD40000-0x000002480CD41000-memory.dmp

      Filesize

      4KB

    • memory/1672-43-0x000002480CD40000-0x000002480CD41000-memory.dmp

      Filesize

      4KB

    • memory/1672-44-0x000002480CD40000-0x000002480CD41000-memory.dmp

      Filesize

      4KB

    • memory/1672-45-0x000002480CD40000-0x000002480CD41000-memory.dmp

      Filesize

      4KB

    • memory/1672-46-0x000002480CD40000-0x000002480CD41000-memory.dmp

      Filesize

      4KB

    • memory/1672-24-0x0000024804740000-0x0000024804750000-memory.dmp

      Filesize

      64KB

    • memory/1672-48-0x000002480CD40000-0x000002480CD41000-memory.dmp

      Filesize

      4KB

    • memory/1672-49-0x000002480CD40000-0x000002480CD41000-memory.dmp

      Filesize

      4KB

    • memory/1672-40-0x000002480CD20000-0x000002480CD21000-memory.dmp

      Filesize

      4KB

    • memory/1672-51-0x000002480C970000-0x000002480C971000-memory.dmp

      Filesize

      4KB

    • memory/1672-52-0x000002480C960000-0x000002480C961000-memory.dmp

      Filesize

      4KB

    • memory/1672-54-0x000002480C970000-0x000002480C971000-memory.dmp

      Filesize

      4KB

    • memory/1672-57-0x000002480C960000-0x000002480C961000-memory.dmp

      Filesize

      4KB

    • memory/1672-60-0x000002480C8A0000-0x000002480C8A1000-memory.dmp

      Filesize

      4KB

    • memory/1672-8-0x0000024804640000-0x0000024804650000-memory.dmp

      Filesize

      64KB

    • memory/1672-72-0x000002480CAA0000-0x000002480CAA1000-memory.dmp

      Filesize

      4KB

    • memory/1672-74-0x000002480CAB0000-0x000002480CAB1000-memory.dmp

      Filesize

      4KB

    • memory/1672-75-0x000002480CAB0000-0x000002480CAB1000-memory.dmp

      Filesize

      4KB

    • memory/1672-76-0x000002480CBC0000-0x000002480CBC1000-memory.dmp

      Filesize

      4KB