wshrat | 76f0269fadaf8730fa587c38fc72fda6ecdb1949894161dc6fdc69b5bba05ca9

General

Target

Detalles Del Comparendo Por La CTE.js
Size

658KB
MD5

d6e145e5a98669b41b35b1ecda1d96a6
SHA1

bef627ba2e04899013ad2732d26d262453477c3f
SHA256

76f0269fadaf8730fa587c38fc72fda6ecdb1949894161dc6fdc69b5bba05ca9
SHA512

9506af2f6dc2ff9e6c50b5658bcdb27ccea5184bed8eac37005db20908dd332e006e78ffa2d4cd99acb3d3e59aa326b04f2cf28f39f1074edccd0a99b79f91d7

Score

10^/10

wshrat persistence trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 15 IoCs

Processes:

wscript.exe

flow	pid	process
8	4768	wscript.exe
10	4768	wscript.exe
16	4768	wscript.exe
20	4768	wscript.exe
21	4768	wscript.exe
22	4768	wscript.exe
23	4768	wscript.exe
24	4768	wscript.exe
25	4768	wscript.exe
26	4768	wscript.exe
27	4768	wscript.exe
28	4768	wscript.exe
29	4768	wscript.exe
30	4768	wscript.exe
31	4768	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Detalles Del Comparendo Por La CTE.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Detalles Del Comparendo Por La CTE.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Detalles Del Comparendo Por La CTE = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Detalles Del Comparendo Por La CTE.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Detalles Del Comparendo Por La CTE = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Detalles Del Comparendo Por La CTE.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
7	ip-api.com

Script User-Agent 14 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	10	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	23	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	16	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	25	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	26	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	27	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	28	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	24	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	30	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	31	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	20	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	21	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	22	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands
HTTP User-Agent header	29	WSHRAT\|22B2BC15\|EWYCRADZ\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 26/2/2021\|JavaScript-v3.3\|NL:Netherlands

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Detalles Del Comparendo Por La CTE.js"
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads