Analysis
-
max time kernel
150s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 13:04
Static task
static1
Behavioral task
behavioral1
Sample
8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe
Resource
win7-20230831-en
General
-
Target
8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe
-
Size
168KB
-
MD5
9ba2229027f01e7ae4fd53c291a2fc06
-
SHA1
381e20e13c6dbf5bd287cc616b7748c09c419c3e
-
SHA256
8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca
-
SHA512
98402fe6ed1c21d3cdde6f4fde79c2b540bc85773f00f811e545f77b740217a15baaa10ef56de22be4eb4b057a73af52267ec45043efedaf1f5e43d2d906f694
-
SSDEEP
3072:pDKW1LgppLRHMY0TBfJvjcTp5Xqy31QinAlSVsr:pDKW1Lgbdl0TBBvjc/jQinAk+
Malware Config
Signatures
-
WSHRAT payload 2 IoCs
resource yara_rule behavioral1/files/0x002300000001558b-45.dat family_wshrat behavioral1/files/0x0026000000015beb-82.dat family_wshrat -
Blocklisted process makes network request 12 IoCs
flow pid Process 6 2496 wscript.exe 7 2496 wscript.exe 10 2496 wscript.exe 11 320 wscript.exe 12 320 wscript.exe 15 320 wscript.exe 16 320 wscript.exe 17 320 wscript.exe 20 320 wscript.exe 21 320 wscript.exe 22 320 wscript.exe 23 320 wscript.exe -
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 2680 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2740 BIN.exe -
Loads dropped DLL 2 IoCs
pid Process 2040 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe 2040 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2740 set thread context of 2736 2740 BIN.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 wscript.exe -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 12 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2040 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2740 2040 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe 28 PID 2040 wrote to memory of 2740 2040 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe 28 PID 2040 wrote to memory of 2740 2040 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe 28 PID 2040 wrote to memory of 2740 2040 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe 28 PID 2040 wrote to memory of 2680 2040 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe 29 PID 2040 wrote to memory of 2680 2040 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe 29 PID 2040 wrote to memory of 2680 2040 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe 29 PID 2040 wrote to memory of 2680 2040 8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe 29 PID 2680 wrote to memory of 2564 2680 cmd.exe 31 PID 2680 wrote to memory of 2564 2680 cmd.exe 31 PID 2680 wrote to memory of 2564 2680 cmd.exe 31 PID 2680 wrote to memory of 2564 2680 cmd.exe 31 PID 2740 wrote to memory of 2736 2740 BIN.exe 32 PID 2740 wrote to memory of 2736 2740 BIN.exe 32 PID 2740 wrote to memory of 2736 2740 BIN.exe 32 PID 2740 wrote to memory of 2736 2740 BIN.exe 32 PID 2740 wrote to memory of 2736 2740 BIN.exe 32 PID 2740 wrote to memory of 2736 2740 BIN.exe 32 PID 2740 wrote to memory of 2736 2740 BIN.exe 32 PID 2740 wrote to memory of 2736 2740 BIN.exe 32 PID 2740 wrote to memory of 2736 2740 BIN.exe 32 PID 2736 wrote to memory of 2496 2736 caspol.exe 33 PID 2736 wrote to memory of 2496 2736 caspol.exe 33 PID 2736 wrote to memory of 2496 2736 caspol.exe 33 PID 2736 wrote to memory of 2496 2736 caspol.exe 33 PID 2496 wrote to memory of 320 2496 wscript.exe 38 PID 2496 wrote to memory of 320 2496 wscript.exe 38 PID 2496 wrote to memory of 320 2496 wscript.exe 38 PID 2496 wrote to memory of 320 2496 wscript.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe"C:\Users\Admin\AppData\Local\Temp\8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\BIN.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\BIN.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\vVqvy.vbs"4⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\vVqvy.vbs"5⤵
- Blocklisted process makes network request
- Modifies system certificate store
PID:320
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\8dd2823b8343b3b64877355cb6b2b9f88d06b4dd586641fde317c592259b99ca.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 13⤵PID:2564
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
180KB
MD59bcc1d31eae798a11b1d50f46b1de92c
SHA18bc898b80ead2433ac20eaa9936d2e40ea1db01e
SHA256cc2ca06bf02d0ba8b9ec6874b734bf6a39f84d536f6bb2d7cc5e3d577697e45b
SHA512b0a13f056ce07f5bf1360cb9754759c499c1560ed19c684f50774d0d6f72e0669b9e10a243185d9c31555938ae2799a09222236d960fb36f935bda266b764d6d
-
Filesize
2.1MB
MD5066dbf69cbfa16c46a2142a257c95f1d
SHA10300eb287c3e29642877772c348c6b683b86a305
SHA256a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906
SHA512c1874bf3d3c6c56168eec1b18242af7562696e9c556ab7612b4c592b78b76286ce80a44cd55222df39f4e85e27cdf19b084dfd0a24127a73615f04545925da7a
-
Filesize
2.1MB
MD5066dbf69cbfa16c46a2142a257c95f1d
SHA10300eb287c3e29642877772c348c6b683b86a305
SHA256a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906
SHA512c1874bf3d3c6c56168eec1b18242af7562696e9c556ab7612b4c592b78b76286ce80a44cd55222df39f4e85e27cdf19b084dfd0a24127a73615f04545925da7a
-
Filesize
180KB
MD59bcc1d31eae798a11b1d50f46b1de92c
SHA18bc898b80ead2433ac20eaa9936d2e40ea1db01e
SHA256cc2ca06bf02d0ba8b9ec6874b734bf6a39f84d536f6bb2d7cc5e3d577697e45b
SHA512b0a13f056ce07f5bf1360cb9754759c499c1560ed19c684f50774d0d6f72e0669b9e10a243185d9c31555938ae2799a09222236d960fb36f935bda266b764d6d
-
Filesize
2.1MB
MD5066dbf69cbfa16c46a2142a257c95f1d
SHA10300eb287c3e29642877772c348c6b683b86a305
SHA256a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906
SHA512c1874bf3d3c6c56168eec1b18242af7562696e9c556ab7612b4c592b78b76286ce80a44cd55222df39f4e85e27cdf19b084dfd0a24127a73615f04545925da7a
-
Filesize
2.1MB
MD5066dbf69cbfa16c46a2142a257c95f1d
SHA10300eb287c3e29642877772c348c6b683b86a305
SHA256a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906
SHA512c1874bf3d3c6c56168eec1b18242af7562696e9c556ab7612b4c592b78b76286ce80a44cd55222df39f4e85e27cdf19b084dfd0a24127a73615f04545925da7a