wshrat | ef487da7a8301df9dca1e74c58433912fca910fb06bc4c941e4c756ce5ff0712

General

Target

InstallSlimPDFReader.js
Size

552KB
MD5

3e3c515ce53a1aedb1fe7e8689f2cd39
SHA1

17b761826748ac4c63232f227d529b59323864d0
SHA256

ef487da7a8301df9dca1e74c58433912fca910fb06bc4c941e4c756ce5ff0712
SHA512

f786aebec2f7f31ca0a4b8d3d3dcad2dc3a5d2405d9a5c8f43aab84145d8a52978ee5861d048d49193bcc5c543d641ea8aeb486a4703ce9d746676a3ff579a13

Score

10^/10

persistence trojan wshrat

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blacklisted process makes network request 20 IoCs

Processes:

wscript.exe

flow	pid	process
7	1752	wscript.exe
9	1752	wscript.exe
10	1752	wscript.exe
11	1752	wscript.exe
12	1752	wscript.exe
13	1752	wscript.exe
14	1752	wscript.exe
15	1752	wscript.exe
17	1752	wscript.exe
18	1752	wscript.exe
19	1752	wscript.exe
21	1752	wscript.exe
22	1752	wscript.exe
23	1752	wscript.exe
25	1752	wscript.exe
26	1752	wscript.exe
27	1752	wscript.exe
29	1752	wscript.exe
30	1752	wscript.exe
31	1752	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

kl-plugin.exe

pid process

1092 kl-plugin.exe

pid	process
1092	kl-plugin.exe

Drops startup file 2 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InstallSlimPDFReader.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InstallSlimPDFReader.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\InstallSlimPDFReader = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\InstallSlimPDFReader.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InstallSlimPDFReader = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\InstallSlimPDFReader.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\InstallSlimPDFReader = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\InstallSlimPDFReader.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InstallSlimPDFReader = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\InstallSlimPDFReader.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ip-api.com
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1140 taskkill.exe

flow	ioc
6	ip-api.com

pid	process
1140	taskkill.exe

Script User-Agent 19 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	9	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	10	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	12	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	21	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	11	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	14	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	18	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	22	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	23	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	29	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	13	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	15	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	17	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	19	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	26	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	25	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	27	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	30	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	31	WSHRAT\|447A9CC6\|UCQFZDUI\|Admin\|Microsoft Windows 7 Professional \|plus\|nan-av\|false - 15/10/2020\|JavaScript-v2.0\|NL:Netherlands

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1140 taskkill.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

kl-plugin.exe

pid process

1092 kl-plugin.exe
1092 kl-plugin.exe

description	pid	process
Token: SeDebugPrivilege	1140	taskkill.exe

pid	process
1092	kl-plugin.exe
1092	kl-plugin.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

wscript.exewscript.execmd.exe

description	pid	process	target process
PID 1440 wrote to memory of 1752	1440	wscript.exe	wscript.exe
PID 1440 wrote to memory of 1752	1440	wscript.exe	wscript.exe
PID 1440 wrote to memory of 1752	1440	wscript.exe	wscript.exe
PID 1752 wrote to memory of 1324	1752	wscript.exe	cmd.exe
PID 1752 wrote to memory of 1324	1752	wscript.exe	cmd.exe
PID 1752 wrote to memory of 1324	1752	wscript.exe	cmd.exe
PID 1324 wrote to memory of 1140	1324	cmd.exe	taskkill.exe
PID 1324 wrote to memory of 1140	1324	cmd.exe	taskkill.exe
PID 1324 wrote to memory of 1140	1324	cmd.exe	taskkill.exe
PID 1752 wrote to memory of 1092	1752	wscript.exe	kl-plugin.exe
PID 1752 wrote to memory of 1092	1752	wscript.exe	kl-plugin.exe
PID 1752 wrote to memory of 1092	1752	wscript.exe	kl-plugin.exe
PID 1752 wrote to memory of 1092	1752	wscript.exe	kl-plugin.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\InstallSlimPDFReader.js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\InstallSlimPDFReader.js"
2⤵
- Blacklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c taskkill /F /IM kl-plugin.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\system32\taskkill.exe
taskkill /F /IM kl-plugin.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Users\Admin\AppData\Roaming\kl-plugin.exe
"C:\Users\Admin\AppData\Roaming\kl-plugin.exe" blackid-43205.portmap.io 1118 "WSHRAT|447A9CC6|UCQFZDUI|Admin|Microsoft Windows 7 Professional |plus|nan-av|false - 15/10/2020|JavaScript-v2.0|NL:Netherlands" 1
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\InstallSlimPDFReader.js
MD5
3e3c515ce53a1aedb1fe7e8689f2cd39

SHA1
17b761826748ac4c63232f227d529b59323864d0

SHA256
ef487da7a8301df9dca1e74c58433912fca910fb06bc4c941e4c756ce5ff0712

SHA512
f786aebec2f7f31ca0a4b8d3d3dcad2dc3a5d2405d9a5c8f43aab84145d8a52978ee5861d048d49193bcc5c543d641ea8aeb486a4703ce9d746676a3ff579a13

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InstallSlimPDFReader.js
MD5
3e3c515ce53a1aedb1fe7e8689f2cd39

SHA1
17b761826748ac4c63232f227d529b59323864d0

SHA256
ef487da7a8301df9dca1e74c58433912fca910fb06bc4c941e4c756ce5ff0712

SHA512
f786aebec2f7f31ca0a4b8d3d3dcad2dc3a5d2405d9a5c8f43aab84145d8a52978ee5861d048d49193bcc5c543d641ea8aeb486a4703ce9d746676a3ff579a13

Download Submit
C:\Users\Admin\AppData\Roaming\kl-plugin.exe
MD5
7099a939fa30d939ccceb2f0597b19ed

SHA1
37b644ef5722709cd9024a372db4590916381976

SHA256
272e64291748fa8be01109faa46c0ea919bf4baf4924177ea6ac2ee0574f1c1a

SHA512
6e179a32b3091beee71d425248ae56495e31e9df569159a93af5826ddef28fba904ae4810d3ca2da45fe6dc8be1eeaecf71e8225b3e605f22f41f4e46d1cf721

Download Submit
C:\Users\Admin\AppData\Roaming\kl-plugin.exe
MD5
7099a939fa30d939ccceb2f0597b19ed

SHA1
37b644ef5722709cd9024a372db4590916381976

SHA256
272e64291748fa8be01109faa46c0ea919bf4baf4924177ea6ac2ee0574f1c1a

SHA512
6e179a32b3091beee71d425248ae56495e31e9df569159a93af5826ddef28fba904ae4810d3ca2da45fe6dc8be1eeaecf71e8225b3e605f22f41f4e46d1cf721

Download Submit
memory/1092-7-0x0000000000000000-mapping.dmp

Download
memory/1140-6-0x0000000000000000-mapping.dmp

Download
memory/1324-5-0x0000000000000000-mapping.dmp

Download
memory/1440-2-0x00000000025E0000-0x00000000025E4000-memory.dmp

Filesize
16KB

Download
memory/1752-0-0x0000000000000000-mapping.dmp

Download
memory/2016-4-0x000007FEF8150000-0x000007FEF83CA000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads