Malware Analysis Report

2025-04-14 08:30

Sample ID 220201-ehmmssghc8
Target c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143
SHA256 c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143
Tags
wshrat persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143

Threat Level: Known bad

The file c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143 was found to be: Known bad.

Malicious Activity Summary

wshrat persistence trojan

WSHRAT

Blocklisted process makes network request

Executes dropped EXE

Drops startup file

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Enumerates physical storage devices

Script User-Agent

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-01 03:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-01 03:56

Reported

2022-02-01 03:59

Platform

win7-en-20211208

Max time kernel

153s

Max time network

152s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js

Signatures

WSHRAT

trojan wshrat

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\bitwork.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ulhUMziPSx.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ulhUMziPSx.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js C:\Windows\system32\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\ulhUMziPSx = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ulhUMziPSx.js\"" C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js\"" C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\woke = "C:\\Users\\Admin\\AppData\\Roaming\\bitwork.exe" C:\Users\Admin\AppData\Roaming\bitwork.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ulhUMziPSx = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ulhUMziPSx.js\"" C:\Windows\System32\wscript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|8C677431|QSKGHMYQ|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\bitwork.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1756 wrote to memory of 452 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1756 wrote to memory of 452 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1756 wrote to memory of 452 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1756 wrote to memory of 1248 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1756 wrote to memory of 1248 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1756 wrote to memory of 1248 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 1248 wrote to memory of 968 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe
PID 1248 wrote to memory of 968 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe
PID 1248 wrote to memory of 968 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe
PID 1248 wrote to memory of 1520 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\bitwork.exe
PID 1248 wrote to memory of 1520 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\bitwork.exe
PID 1248 wrote to memory of 1520 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\bitwork.exe
PID 1248 wrote to memory of 1520 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\bitwork.exe
PID 1248 wrote to memory of 1520 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\bitwork.exe
PID 1248 wrote to memory of 1520 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\bitwork.exe
PID 1248 wrote to memory of 1520 N/A C:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\bitwork.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ulhUMziPSx.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ulhUMziPSx.js"

C:\Users\Admin\AppData\Roaming\bitwork.exe

"C:\Users\Admin\AppData\Roaming\bitwork.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 pluginsrv2.duckdns.org udp
US 208.95.112.1:80 ip-api.com tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp

Files

memory/1756-55-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

C:\Users\Admin\AppData\Roaming\ulhUMziPSx.js

MD5 5c7a4075926a9f7bd042a4b19710545e
SHA1 4a067052d404fa6c52e4bb25c645d28cdf2ca5fb
SHA256 0283741629dc677d604f0e33d06cb69e4db2e980093bf8de2410d12648c57eb1
SHA512 9f0163838db4f0e51a3064240451b466e6290f1dda3946779e57aa4168d02135d75b4cf7e2904681ded7f47e9a35fa75293e5c77b64adbfcfa200d100e22105e

C:\Users\Admin\AppData\Roaming\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js

MD5 394f8e6df802d303487795e7edb76ad0
SHA1 67bb4fe378952026e7c970cadd3798b379c99bdb
SHA256 c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143
SHA512 d5db02e1aaf9da76572489a51bde11e3e91f9f860e5c835c6f859eac0edda7bd5487ece4f2f82346d76a79c159010eb6e3295f945c8acd188d8c5685e716cc15

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js

MD5 394f8e6df802d303487795e7edb76ad0
SHA1 67bb4fe378952026e7c970cadd3798b379c99bdb
SHA256 c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143
SHA512 d5db02e1aaf9da76572489a51bde11e3e91f9f860e5c835c6f859eac0edda7bd5487ece4f2f82346d76a79c159010eb6e3295f945c8acd188d8c5685e716cc15

C:\Users\Admin\AppData\Roaming\bitwork.exe

MD5 42f9ae998d34dd78124e26e1ca1ff02b
SHA1 640a74e9a99b811a4b369b3c50988061b5c805c7
SHA256 d5981944f6c22372071e6086b7952be5a8bca3b4961030bea0ed4eacc8f6c096
SHA512 20f42c32fcf160ca96ce87fa1609500452a4327e08accb3f664e63d8955ce21eac2ceb2541363d76252f2e20cb33d56f1f8cc5cdb0e46de36206d8182024b303

C:\Users\Admin\AppData\Roaming\bitwork.exe

MD5 42f9ae998d34dd78124e26e1ca1ff02b
SHA1 640a74e9a99b811a4b369b3c50988061b5c805c7
SHA256 d5981944f6c22372071e6086b7952be5a8bca3b4961030bea0ed4eacc8f6c096
SHA512 20f42c32fcf160ca96ce87fa1609500452a4327e08accb3f664e63d8955ce21eac2ceb2541363d76252f2e20cb33d56f1f8cc5cdb0e46de36206d8182024b303

memory/1520-63-0x0000000001170000-0x0000000001178000-memory.dmp

memory/1520-64-0x00000000769D1000-0x00000000769D3000-memory.dmp

memory/1520-65-0x0000000004960000-0x0000000004961000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-01 03:56

Reported

2022-02-01 03:59

Platform

win10v2004-en-20220113

Max time kernel

23s

Max time network

33s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js

Signatures

WSHRAT

trojan wshrat

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\bitwork.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Windows\System32\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ulhUMziPSx.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ulhUMziPSx.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js C:\Windows\System32\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ulhUMziPSx = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ulhUMziPSx.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js\"" C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woke = "C:\\Users\\Admin\\AppData\\Roaming\\bitwork.exe" C:\Users\Admin\AppData\Roaming\bitwork.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ulhUMziPSx = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ulhUMziPSx.js\"" C:\Windows\System32\wscript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|5C0A896F|JDQPXOPR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A
HTTP User-Agent header WSHRAT|5C0A896F|JDQPXOPR|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 1/2/2022|JavaScript-v1.6 N/A N/A

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ulhUMziPSx.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ulhUMziPSx.js"

C:\Users\Admin\AppData\Roaming\bitwork.exe

"C:\Users\Admin\AppData\Roaming\bitwork.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pluginsrv2.duckdns.org udp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 134.122.27.220:5678 tcp
NL 178.79.208.1:80 tcp
NL 178.79.208.1:80 tcp
US 192.169.69.25:8000 pluginsrv2.duckdns.org tcp
US 134.122.27.220:5678 tcp

Files

C:\Users\Admin\AppData\Roaming\ulhUMziPSx.js

MD5 5c7a4075926a9f7bd042a4b19710545e
SHA1 4a067052d404fa6c52e4bb25c645d28cdf2ca5fb
SHA256 0283741629dc677d604f0e33d06cb69e4db2e980093bf8de2410d12648c57eb1
SHA512 9f0163838db4f0e51a3064240451b466e6290f1dda3946779e57aa4168d02135d75b4cf7e2904681ded7f47e9a35fa75293e5c77b64adbfcfa200d100e22105e

C:\Users\Admin\AppData\Roaming\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js

MD5 394f8e6df802d303487795e7edb76ad0
SHA1 67bb4fe378952026e7c970cadd3798b379c99bdb
SHA256 c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143
SHA512 d5db02e1aaf9da76572489a51bde11e3e91f9f860e5c835c6f859eac0edda7bd5487ece4f2f82346d76a79c159010eb6e3295f945c8acd188d8c5685e716cc15

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143.js

MD5 394f8e6df802d303487795e7edb76ad0
SHA1 67bb4fe378952026e7c970cadd3798b379c99bdb
SHA256 c9ef5a98d32858facd2ea6354196969080b87cb684295830d983293a25daf143
SHA512 d5db02e1aaf9da76572489a51bde11e3e91f9f860e5c835c6f859eac0edda7bd5487ece4f2f82346d76a79c159010eb6e3295f945c8acd188d8c5685e716cc15

C:\Users\Admin\AppData\Roaming\bitwork.exe

MD5 42f9ae998d34dd78124e26e1ca1ff02b
SHA1 640a74e9a99b811a4b369b3c50988061b5c805c7
SHA256 d5981944f6c22372071e6086b7952be5a8bca3b4961030bea0ed4eacc8f6c096
SHA512 20f42c32fcf160ca96ce87fa1609500452a4327e08accb3f664e63d8955ce21eac2ceb2541363d76252f2e20cb33d56f1f8cc5cdb0e46de36206d8182024b303

C:\Users\Admin\AppData\Roaming\bitwork.exe

MD5 42f9ae998d34dd78124e26e1ca1ff02b
SHA1 640a74e9a99b811a4b369b3c50988061b5c805c7
SHA256 d5981944f6c22372071e6086b7952be5a8bca3b4961030bea0ed4eacc8f6c096
SHA512 20f42c32fcf160ca96ce87fa1609500452a4327e08accb3f664e63d8955ce21eac2ceb2541363d76252f2e20cb33d56f1f8cc5cdb0e46de36206d8182024b303

memory/2876-141-0x0000000000E60000-0x0000000000E68000-memory.dmp

memory/2876-142-0x0000000005EB0000-0x0000000006454000-memory.dmp

memory/2876-143-0x0000000005810000-0x00000000058A2000-memory.dmp