Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 21:31
Static task
static1
Behavioral task
behavioral1
Sample
Dadebehring PendingInvoiceBankDetails.JS.js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Dadebehring PendingInvoiceBankDetails.JS.js
Resource
win10v2004-20240419-en
General
-
Target
Dadebehring PendingInvoiceBankDetails.JS.js
-
Size
615KB
-
MD5
0b7c8b483dbe9dd80dcfc2efc2fe3595
-
SHA1
097e1054b08e5b6e454def018a04e865fb02874c
-
SHA256
019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258
-
SHA512
118be8d4c92581e3f51330eebfd5e7c5549e21b5d466d68799ddd6e7dc47b82e08f1924fabb7f049e0739da6f079983f4a2b87ab2957dc260b4763362406a321
-
SSDEEP
12288:rYeIrWr/qRigAyX/kngXFbjTLvaH28nZH19Iimg0VtxWvTbxzOObcizI/mofdEMt:rYeIrWr/qRigAyX/kngXFbjTLvaH28nQ
Malware Config
Extracted
wshrat
http://masterokrwh.duckdns.org:8426
Signatures
-
Blocklisted process makes network request 28 IoCs
Processes:
wscript.exeflow pid process 4 2912 wscript.exe 6 2912 wscript.exe 7 2912 wscript.exe 13 2912 wscript.exe 36 2912 wscript.exe 37 2912 wscript.exe 44 2912 wscript.exe 45 2912 wscript.exe 46 2912 wscript.exe 60 2912 wscript.exe 61 2912 wscript.exe 62 2912 wscript.exe 63 2912 wscript.exe 64 2912 wscript.exe 68 2912 wscript.exe 77 2912 wscript.exe 78 2912 wscript.exe 79 2912 wscript.exe 80 2912 wscript.exe 87 2912 wscript.exe 98 2912 wscript.exe 99 2912 wscript.exe 100 2912 wscript.exe 101 2912 wscript.exe 102 2912 wscript.exe 103 2912 wscript.exe 104 2912 wscript.exe 105 2912 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dadebehring PendingInvoiceBankDetails.JS.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dadebehring PendingInvoiceBankDetails.JS.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dadebehring PendingInvoiceBankDetails = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dadebehring PendingInvoiceBankDetails.JS.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dadebehring PendingInvoiceBankDetails = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dadebehring PendingInvoiceBankDetails.JS.js\"" wscript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 27 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 61 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 60 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 79 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 104 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 13 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 44 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 45 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 37 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 101 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 105 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 80 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 87 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 103 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 98 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 99 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 36 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 63 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 68 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 77 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 78 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 46 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 62 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 64 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 100 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 102 WSHRAT|20FDBEDC|EXNCLZLI|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 2/5/2024|JavaScript-v3.4|GB:United Kingdom
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dadebehring PendingInvoiceBankDetails.JS.js
Filesize615KB
MD50b7c8b483dbe9dd80dcfc2efc2fe3595
SHA1097e1054b08e5b6e454def018a04e865fb02874c
SHA256019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258
SHA512118be8d4c92581e3f51330eebfd5e7c5549e21b5d466d68799ddd6e7dc47b82e08f1924fabb7f049e0739da6f079983f4a2b87ab2957dc260b4763362406a321