wshrat | 588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468

General

Target
588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468.vbs
Size 308KB
Sample220327-jcmstsehf9
SHA256 588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468
MD5 5eceebc0b8356d1e8681fc1ef55499de
SHA1 0d87c9ed3053a68066928b8abd3c739c0839834d
SHA512 a9c84a6a828f7ca3e8a9e9729775828f1a0f18820092c080a19053079c8d7e50afcb033fcd7147b0e0266dfbafeb092242074228f6429e5810c70fdeb24bf0d2
MD5 SHA1 SHA512

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

C2

http://aduezenwayi.duckdns.org:5002

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 12 IoCs

flow	pid	Process
15	4912	wscript.exe
18	4912	wscript.exe
19	4912	wscript.exe
20	4912	wscript.exe
21	4912	wscript.exe
22	4912	wscript.exe
23	4912	wscript.exe
24	4912	wscript.exe
25	4912	wscript.exe
26	4912	wscript.exe
27	4912	wscript.exe
28	4912	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468.vbs	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468.vbs\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468.vbs\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468.vbs\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468.vbs\""	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4912	4844	WScript.exe	79
PID 4844 wrote to memory of 4912	4844	WScript.exe	79

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468.vbs"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:4912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468.vbs

Path C:\Users\Admin\AppData\Roaming\588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468.vbs
Size 308KB
SHA256 588f87393629a7f3e8602d70891f5afd69a46bffe7a098366077ca7c6c5e6468
MD5 5eceebc0b8356d1e8681fc1ef55499de
SHA1 0d87c9ed3053a68066928b8abd3c739c0839834d
SHA512 a9c84a6a828f7ca3e8a9e9729775828f1a0f18820092c080a19053079c8d7e50afcb033fcd7147b0e0266dfbafeb092242074228f6429e5810c70fdeb24bf0d2
SSDEEP 768:gICUEizfm/H2mojLFxKXA7wM7ZiSiWFTddNVLm:g
MD5 SHA1 SHA512 SSDEEP

Submit Download