Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-05-2024 01:04
Static task
static1
Behavioral task
behavioral1
Sample
019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258.js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258.js
Resource
win10v2004-20240419-en
General
-
Target
019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258.js
-
Size
615KB
-
MD5
0b7c8b483dbe9dd80dcfc2efc2fe3595
-
SHA1
097e1054b08e5b6e454def018a04e865fb02874c
-
SHA256
019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258
-
SHA512
118be8d4c92581e3f51330eebfd5e7c5549e21b5d466d68799ddd6e7dc47b82e08f1924fabb7f049e0739da6f079983f4a2b87ab2957dc260b4763362406a321
-
SSDEEP
12288:rYeIrWr/qRigAyX/kngXFbjTLvaH28nZH19Iimg0VtxWvTbxzOObcizI/mofdEMt:rYeIrWr/qRigAyX/kngXFbjTLvaH28nQ
Malware Config
Extracted
wshrat
http://masterokrwh.duckdns.org:8426
Signatures
-
Blocklisted process makes network request 31 IoCs
flow pid Process 4 2056 wscript.exe 6 2056 wscript.exe 7 2056 wscript.exe 10 2056 wscript.exe 11 2056 wscript.exe 12 2056 wscript.exe 14 2056 wscript.exe 15 2056 wscript.exe 16 2056 wscript.exe 18 2056 wscript.exe 19 2056 wscript.exe 20 2056 wscript.exe 22 2056 wscript.exe 23 2056 wscript.exe 24 2056 wscript.exe 26 2056 wscript.exe 27 2056 wscript.exe 28 2056 wscript.exe 30 2056 wscript.exe 31 2056 wscript.exe 32 2056 wscript.exe 34 2056 wscript.exe 35 2056 wscript.exe 36 2056 wscript.exe 38 2056 wscript.exe 39 2056 wscript.exe 40 2056 wscript.exe 42 2056 wscript.exe 43 2056 wscript.exe 44 2056 wscript.exe 46 2056 wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258.js\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258.js\"" wscript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 pastebin.com 7 pastebin.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 30 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 38 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 42 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 20 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 28 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 31 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 40 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 10 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 19 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 22 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 43 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 12 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 14 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 27 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 30 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 35 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 39 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 44 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 11 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 16 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 34 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 15 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 18 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 23 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 26 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 32 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 46 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom HTTP User-Agent header 36 WSHRAT|D0F97DBD|IZKCKOTP|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 3/5/2024|JavaScript-v3.4|GB:United Kingdom
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258.js
Filesize615KB
MD50b7c8b483dbe9dd80dcfc2efc2fe3595
SHA1097e1054b08e5b6e454def018a04e865fb02874c
SHA256019e983d91ef29bce54e750ec620a7e63418f34c9a393f3f44e11cbfa39c2258
SHA512118be8d4c92581e3f51330eebfd5e7c5549e21b5d466d68799ddd6e7dc47b82e08f1924fabb7f049e0739da6f079983f4a2b87ab2957dc260b4763362406a321