wshrat | 52b7322206663f810e900cbbf2f38a6b39303619c34ff26ff4cd6b7914523147

General

Target
CamScanner 24-07-2021 10.36.pdf.js
Size 412KB
Sample210724-9fpltsb6f2
SHA256 52b7322206663f810e900cbbf2f38a6b39303619c34ff26ff4cd6b7914523147
MD5 d1a0a6dea503e07048ae4fcaf7695a5b
SHA1 e11873e54ace729c6cac3cf0d8d09b17a2a0515d
SHA512 2647f49d050cfa72594391b904bfd670212b4b4c4661b8f772e33d01021c63ef93fee7c03ed4422ff03fee4c9013bb3791a770544dba9412759b766406f3f0bf
MD5 SHA1 SHA512

Score

10^/10

wshrat persistence suricata trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat
suricata: ET MALWARE WSHRAT CnC Checkin
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
suricata

Blocklisted process makes network request 6 IoCs

flow	pid	Process
8	1284	wscript.exe
10	1284	wscript.exe
16	1284	wscript.exe
20	1284	wscript.exe
21	1284	wscript.exe
22	1284	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4064	kl-plugin.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CamScanner 24-07-2021 10.36.pdf.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CamScanner 24-07-2021 10.36.pdf.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\CamScanner 24-07-2021 10 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\CamScanner 24-07-2021 10.36.pdf.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CamScanner 24-07-2021 10 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\CamScanner 24-07-2021 10.36.pdf.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\CamScanner 24-07-2021 10 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\CamScanner 24-07-2021 10.36.pdf.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CamScanner 24-07-2021 10 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\CamScanner 24-07-2021 10.36.pdf.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
3120	taskkill.exe

Script User-Agent 5 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	10	WSHRAT\|A2C56C1C\|RJMQBVDN\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 24/7/2021\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	16	WSHRAT\|A2C56C1C\|RJMQBVDN\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 24/7/2021\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	20	WSHRAT\|A2C56C1C\|RJMQBVDN\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 24/7/2021\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	21	WSHRAT\|A2C56C1C\|RJMQBVDN\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 24/7/2021\|JavaScript-v2.0\|NL:Netherlands
HTTP User-Agent header	22	WSHRAT\|A2C56C1C\|RJMQBVDN\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 24/7/2021\|JavaScript-v2.0\|NL:Netherlands

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3120	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4064	kl-plugin.exe
4064	kl-plugin.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1284	3920	wscript.exe	75
PID 3920 wrote to memory of 1284	3920	wscript.exe	75
PID 1284 wrote to memory of 3968	1284	wscript.exe	77
PID 1284 wrote to memory of 3968	1284	wscript.exe	77
PID 3968 wrote to memory of 3120	3968	cmd.exe	79
PID 3968 wrote to memory of 3120	3968	cmd.exe	79
PID 1284 wrote to memory of 4064	1284	wscript.exe	80
PID 1284 wrote to memory of 4064	1284	wscript.exe	80
PID 1284 wrote to memory of 4064	1284	wscript.exe	80

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\CamScanner 24-07-2021 10.36.pdf.js"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\CamScanner 24-07-2021 10.36.pdf.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /F /IM kl-plugin.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM kl-plugin.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3120
- - C:\Users\Admin\AppData\Roaming\kl-plugin.exe
    "C:\Users\Admin\AppData\Roaming\kl-plugin.exe" abrilwsh2021.duckdns.org 2021 "WSHRAT|A2C56C1C|RJMQBVDN|Admin|Microsoft Windows 10 Enterprise|plus|nan-av|false - 24/7/2021|JavaScript-v2.0|NL:Netherlands" 1
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4064-122-0x0000000002B20000-0x0000000002B21000-memory.dmp

Download

Analysis

Sharing