Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2024 16:30
Static task
static1
Behavioral task
behavioral1
Sample
quotation.js
Resource
win7-20231215-en
General
-
Target
quotation.js
-
Size
944KB
-
MD5
88ae41b328e244baa40100550813c37c
-
SHA1
b098a717c8f618187bec8cf50aa0bee09bce7268
-
SHA256
cd0f3713f71701451538380e8c219b0cf0f490cb560760a3e346c6559e823d0f
-
SHA512
dfb9e92280da0156a8169b43e0cd3690f1cf60a5f32f40ef9cc7ab67c66463d141957d9259e210a520398a92b257012a4608e62954a912538f3952a8ecf97b5f
-
SSDEEP
6144:XQyIasDlZGlFVd94aBSGgVG5S7lN4Bw0JHqg8Mspk+w9304+7mfSFsnG6Qbfa7wG:go
Malware Config
Extracted
wshrat
http://harold.jetos.com:3609
Signatures
-
Blocklisted process makes network request 16 IoCs
Processes:
wscript.exeflow pid process 9 2876 wscript.exe 13 2876 wscript.exe 21 2876 wscript.exe 28 2876 wscript.exe 29 2876 wscript.exe 36 2876 wscript.exe 44 2876 wscript.exe 50 2876 wscript.exe 51 2876 wscript.exe 58 2876 wscript.exe 62 2876 wscript.exe 69 2876 wscript.exe 71 2876 wscript.exe 74 2876 wscript.exe 75 2876 wscript.exe 79 2876 wscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exewscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\quotation.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\quotation.js wscript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 15 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 13 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 71 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 58 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 28 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 44 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 62 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 21 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 51 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 50 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 69 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 74 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 75 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 79 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 29 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 36 WSHRAT|FA1DFF30|IXMQMCCR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/1/2024|JavaScript-v3.4|GB:United Kingdom -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
wscript.exedescription pid process target process PID 4132 wrote to memory of 2876 4132 wscript.exe wscript.exe PID 4132 wrote to memory of 2876 4132 wscript.exe wscript.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\quotation.js1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\quotation.js"2⤵
- Blocklisted process makes network request
- Drops startup file
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\quotation.jsFilesize
944KB
MD588ae41b328e244baa40100550813c37c
SHA1b098a717c8f618187bec8cf50aa0bee09bce7268
SHA256cd0f3713f71701451538380e8c219b0cf0f490cb560760a3e346c6559e823d0f
SHA512dfb9e92280da0156a8169b43e0cd3690f1cf60a5f32f40ef9cc7ab67c66463d141957d9259e210a520398a92b257012a4608e62954a912538f3952a8ecf97b5f