wshrat | b04ebbaab95d8941912761529774630b138c48e08c55462dc1191c5258d909fd

General

Target
GH2-19062016_PO_TOP URGENT.js
Size 104KB
Sample220121-3ahkwacfb4
SHA256 345e93e6986cea0e9f2ce63ec4d2c6b34afe35c3300f7802b92176bafdc5a84c
MD5 c4a3c287a91653de36fe458599b226e3
SHA1 5da2f1e0f11a82df50d970db65d48c9575d3111a
SHA512 c3662f002f2969bda521d0b607d9686c2ccbb1b687865658f3b9789246dbcddb5664046e00308569e9c5accf177008de88214bba35eb0c1c587356b1b5adb5c6
MD5 SHA1 SHA512

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

C2

http://ghostwsh4191.ddns.net:4191

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 12 IoCs

flow	pid	Process
10	2424	wscript.exe
11	988	wscript.exe
25	2424	wscript.exe
26	988	wscript.exe
28	988	wscript.exe
29	2424	wscript.exe
32	988	wscript.exe
33	2424	wscript.exe
34	988	wscript.exe
35	2424	wscript.exe
36	988	wscript.exe
37	2424	wscript.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GH2-19062016_PO_TOP URGENT.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GH2-19062016_PO_TOP URGENT.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gXuCYRVlKo.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gXuCYRVlKo.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GH2-19062016_PO_TOP URGENT = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\GH2-19062016_PO_TOP URGENT.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\gXuCYRVlKo = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\gXuCYRVlKo.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gXuCYRVlKo = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\gXuCYRVlKo.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\GH2-19062016_PO_TOP URGENT = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\GH2-19062016_PO_TOP URGENT.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	35	WSHRAT\|A441E75A\|MHKKHUYI\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 25/1/2022\|JavaScript-v1.3
HTTP User-Agent header	37	WSHRAT\|A441E75A\|MHKKHUYI\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 25/1/2022\|JavaScript-v1.3
HTTP User-Agent header	10	WSHRAT\|A441E75A\|MHKKHUYI\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 25/1/2022\|JavaScript-v1.3
HTTP User-Agent header	25	WSHRAT\|A441E75A\|MHKKHUYI\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 25/1/2022\|JavaScript-v1.3
HTTP User-Agent header	29	WSHRAT\|A441E75A\|MHKKHUYI\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 25/1/2022\|JavaScript-v1.3
HTTP User-Agent header	33	WSHRAT\|A441E75A\|MHKKHUYI\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 25/1/2022\|JavaScript-v1.3

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 988	2424	wscript.exe	68
PID 2424 wrote to memory of 988	2424	wscript.exe	68

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\GH2-19062016_PO_TOP URGENT.js"
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\gXuCYRVlKo.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-140-0x0000014F97B3B000-0x0000014F98760000-memory.dmp

Download

memory/2424-122-0x0000020771410000-0x0000020772100000-memory.dmp