wshrat | ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC.js\""	wscript.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F587C0AE-C7F6-48ED-AF1A-D9AB65974143}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Script User-Agent 29 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	54	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	90	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	67	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	74	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	79	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	82	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	83	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	88	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	73	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	77	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	37	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	71	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	76	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	81	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	26	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	36	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	38	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	69	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	85	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	51	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	72	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	78	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	70	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	80	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	66	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	68	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	75	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	84	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript
HTTP User-Agent header	91	WSHRAT\|FA6AE306\|DIREXETO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 14/9/2023\|JavaScript

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1680	2252	wscript.exe	88
PID 2252 wrote to memory of 1680	2252	wscript.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:684

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC.js
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ae69570258cabd6bbede57ef510836d167c0d9b1752d3d742f8e4769e17eba15_JC.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

4

System Information Discovery

4