Analysis
-
max time kernel
1099s -
max time network
1794s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 15:20
Static task
static1
Behavioral task
behavioral1
Sample
38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf.vbs
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf.vbs
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf.vbs
-
Size
254KB
-
MD5
bfb4e820b764be9c6ca3a7be5afdc124
-
SHA1
21e8d148050fa80830ee64cbf99d67292a21fabc
-
SHA256
38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf
-
SHA512
506a151144d5323156066d1a746bd3d9e14b99a170d1e89d9424a5a98dd05a794ab0aa32766b073f58ad866716ef25972b3a44a9d56fad80003c0abf13ced27f
-
SSDEEP
6144:ywKmqM4d6gb5mjTS8EoL36Uc2TEspbmWVX7FilDCtzQbxkGsg5:QdeTSWdI8mWVM+OGHs
Malware Config
Extracted
wshrat
http://poseidon99.duckdns.org:4758
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 5 2784 WScript.exe 7 2784 WScript.exe 8 2784 WScript.exe 9 2784 WScript.exe 11 2784 WScript.exe 12 2784 WScript.exe 13 2784 WScript.exe 15 2784 WScript.exe 16 2784 WScript.exe 17 2784 WScript.exe 19 2784 WScript.exe 20 2784 WScript.exe 21 2784 WScript.exe 23 2784 WScript.exe 24 2784 WScript.exe 25 2784 WScript.exe 27 2784 WScript.exe 28 2784 WScript.exe 29 2784 WScript.exe 31 2784 WScript.exe 32 2784 WScript.exe 33 2784 WScript.exe 35 2784 WScript.exe 36 2784 WScript.exe 37 2784 WScript.exe 39 2784 WScript.exe 40 2784 WScript.exe 41 2784 WScript.exe 43 2784 WScript.exe 44 2784 WScript.exe 47 2784 WScript.exe 48 2784 WScript.exe 50 2784 WScript.exe 51 2784 WScript.exe 52 2784 WScript.exe 54 2784 WScript.exe 55 2784 WScript.exe 56 2784 WScript.exe 58 2784 WScript.exe 59 2784 WScript.exe 60 2784 WScript.exe 62 2784 WScript.exe 63 2784 WScript.exe 64 2784 WScript.exe 66 2784 WScript.exe 67 2784 WScript.exe 68 2784 WScript.exe 70 2784 WScript.exe 71 2784 WScript.exe 72 2784 WScript.exe 74 2784 WScript.exe 75 2784 WScript.exe 76 2784 WScript.exe 78 2784 WScript.exe 79 2784 WScript.exe 80 2784 WScript.exe 82 2784 WScript.exe 83 2784 WScript.exe 84 2784 WScript.exe 86 2784 WScript.exe 87 2784 WScript.exe 88 2784 WScript.exe 90 2784 WScript.exe 91 2784 WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf.vbs\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf.vbs\"" WScript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2784 wrote to memory of 3024 2784 WScript.exe 19 PID 2784 wrote to memory of 3024 2784 WScript.exe 19 PID 2784 wrote to memory of 3024 2784 WScript.exe 19
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf.vbs"1⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\skbgbpTewK.vbs"2⤵PID:3024
-