wshrat | 262329afc152fa7205598cc6e67751a7b0634e65d2c15cbdb3d4da377a2408c1

General

Target

Finanzierung.js
Size

179KB
MD5

0bc9b5360f88fc7228a93b15ac0a879a
SHA1

f1dd1957da7d8fd715bdcd5ce3579c30bd727e88
SHA256

262329afc152fa7205598cc6e67751a7b0634e65d2c15cbdb3d4da377a2408c1
SHA512

a44bd6b7e4c57b7784c96f8f0176d000a330f413b96f3dfe9221368fce37e28814d5aa8034ccfa0918348cfb174269afe94037a14301b9836e11ad119160cc45

Score

10^/10

wshrat persistence trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Finanzierung.js	family_wshrat
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Finanzierung.js	family_wshrat

Blocklisted process makes network request 42 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
3	2008	wscript.exe
4	872	wscript.exe
9	872	wscript.exe
10	872	wscript.exe
11	872	wscript.exe
12	872	wscript.exe
13	872	wscript.exe
14	872	wscript.exe
15	872	wscript.exe
17	872	wscript.exe
18	872	wscript.exe
19	872	wscript.exe
20	872	wscript.exe
21	872	wscript.exe
22	872	wscript.exe
24	872	wscript.exe
25	872	wscript.exe
26	872	wscript.exe
27	872	wscript.exe
28	872	wscript.exe
29	872	wscript.exe
31	872	wscript.exe
32	872	wscript.exe
33	872	wscript.exe
34	872	wscript.exe
35	872	wscript.exe
36	872	wscript.exe
38	872	wscript.exe
39	872	wscript.exe
40	872	wscript.exe
41	872	wscript.exe
42	872	wscript.exe
43	872	wscript.exe
45	872	wscript.exe
46	872	wscript.exe
47	872	wscript.exe
48	872	wscript.exe
49	872	wscript.exe
50	872	wscript.exe
52	872	wscript.exe
53	872	wscript.exe
54	872	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Finanzierung.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Finanzierung.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Finanzierung = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Finanzierung.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Finanzierung = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Finanzierung.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Finanzierung = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Finanzierung.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Finanzierung = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Finanzierung.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\software\microsoft\windows\currentversion\run	wscript.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
8	ip-api.com

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 2008 wrote to memory of 872	2008	wscript.exe	wscript.exe
PID 2008 wrote to memory of 872	2008	wscript.exe	wscript.exe
PID 2008 wrote to memory of 872	2008	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Finanzierung.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Finanzierung.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Finanzierung.js

MD5
0bc9b5360f88fc7228a93b15ac0a879a

SHA1
f1dd1957da7d8fd715bdcd5ce3579c30bd727e88

SHA256
262329afc152fa7205598cc6e67751a7b0634e65d2c15cbdb3d4da377a2408c1

SHA512
a44bd6b7e4c57b7784c96f8f0176d000a330f413b96f3dfe9221368fce37e28814d5aa8034ccfa0918348cfb174269afe94037a14301b9836e11ad119160cc45

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Finanzierung.js

MD5
0bc9b5360f88fc7228a93b15ac0a879a

SHA1
f1dd1957da7d8fd715bdcd5ce3579c30bd727e88

SHA256
262329afc152fa7205598cc6e67751a7b0634e65d2c15cbdb3d4da377a2408c1

SHA512
a44bd6b7e4c57b7784c96f8f0176d000a330f413b96f3dfe9221368fce37e28814d5aa8034ccfa0918348cfb174269afe94037a14301b9836e11ad119160cc45

Download Submit
memory/872-2-0x0000000000000000-mapping.dmp

Download
memory/1912-6-0x000007FEF6850000-0x000007FEF6ACA000-memory.dmp

Filesize
2.5MB

Download
memory/2008-4-0x00000000025D0000-0x00000000025D4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads