wshrat | 5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
29/03/2022, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe
Size 688KB
Sample220329-xp7knaebaj
SHA256 5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd
MD5 c8e9e32130eab44f86961b093ba99819
SHA1 2a1c3bb1dc8373d3469a1e82b148c9fdab860932
SHA512 7c886d9fccbec2699cca01dedfde35b1305bd24e42ba709cf992cb632e15e61d482f431b5f85005922091b0602c17e63a5b37880be999a7dd49ede38c25c82fa
MD5 SHA1 SHA512

Score

10^/10

wshrat trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT Payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000001e7dd-147.dat	family_wshrat

Executes dropped EXE 3 IoCs

pid	Process
2396	ctfmon.exe
2308	InstallUtil.exe
4512	InstallUtil.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	InstallUtil.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 2308	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	92
PID 2308 set thread context of 4512	2308	InstallUtil.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe
1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe
2308	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe
Token: SeDebugPrivilege	2308	InstallUtil.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2396	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	90
PID 1652 wrote to memory of 2396	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	90
PID 1652 wrote to memory of 2396	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	90
PID 1652 wrote to memory of 2308	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	92
PID 1652 wrote to memory of 2308	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	92
PID 1652 wrote to memory of 2308	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	92
PID 1652 wrote to memory of 2308	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	92
PID 1652 wrote to memory of 2308	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	92
PID 1652 wrote to memory of 2308	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	92
PID 1652 wrote to memory of 2308	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	92
PID 1652 wrote to memory of 2308	1652	5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe	92
PID 2308 wrote to memory of 4512	2308	InstallUtil.exe	93
PID 2308 wrote to memory of 4512	2308	InstallUtil.exe	93
PID 2308 wrote to memory of 4512	2308	InstallUtil.exe	93
PID 2308 wrote to memory of 4512	2308	InstallUtil.exe	93
PID 2308 wrote to memory of 4512	2308	InstallUtil.exe	93
PID 2308 wrote to memory of 4512	2308	InstallUtil.exe	93
PID 2308 wrote to memory of 4512	2308	InstallUtil.exe	93
PID 2308 wrote to memory of 4512	2308	InstallUtil.exe	93
PID 4512 wrote to memory of 2476	4512	InstallUtil.exe	94
PID 4512 wrote to memory of 2476	4512	InstallUtil.exe	94
PID 4512 wrote to memory of 2476	4512	InstallUtil.exe	94
PID 2476 wrote to memory of 1732	2476	wscript.exe	95
PID 2476 wrote to memory of 1732	2476	wscript.exe	95
PID 2476 wrote to memory of 1732	2476	wscript.exe	95

C:\Users\Admin\AppData\Local\Temp\5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe
"C:\Users\Admin\AppData\Local\Temp\5f958d7477fd4601ddf8d74803f40434fd571207aacbd20332887f51e97fb7fd.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\Desktop\ctfmon.exe
  "C:\Users\Admin\Desktop\ctfmon.exe"
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\emvTV.vbs
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:2476
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\emvTV.vbs" /elevated
        5⤵
        
        PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallUtil.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log
Size 1KB
SHA256 8531e342939d35c6183ee942bdf73298b921e1d6138426f7040aa2774495e8d7
MD5 c3aa504d1c7765905adabb45cdb8a9ac
SHA1 9e267ff0492927b287a0d14225ade45304bf304d
SHA512 546a734104d35610204e3c8e0f080056f53a49f0b4db7824e5c985080b64f403794c1dda897ebb0d659ed3912913cfddab29bd713710159ff77bf68dba2a925a
MD5 SHA1 SHA512

Submit Download

InstallUtil.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Size 41KB
SHA256 ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
MD5 5d4073b2eb6d217c19f2b22f21bf8d57
SHA1 f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA512 9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
MD5 SHA1 SHA512

Submit Download

InstallUtil.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Size 41KB
SHA256 ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
MD5 5d4073b2eb6d217c19f2b22f21bf8d57
SHA1 f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA512 9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
MD5 SHA1 SHA512

Submit Download

InstallUtil.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Size 41KB
SHA256 ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
MD5 5d4073b2eb6d217c19f2b22f21bf8d57
SHA1 f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA512 9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
MD5 SHA1 SHA512

Submit Download

e.dll

Path C:\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll
Size 94KB
SHA256 fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
MD5 14ff402962ad21b78ae0b4c43cd1f194
SHA1 f8a510eb26666e875a5bdd1cadad40602763ad72
SHA512 daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
MD5 SHA1 SHA512

Submit Download

emvTV.vbs

Path C:\Users\Admin\AppData\Roaming\emvTV.vbs
Size 180KB
SHA256 061392d433643f17e83e15135c813dc18d0e91c04c43c07f3e637553f4ef93a1
MD5 fa07967e2df59c2c2c569ffe70d5a05e
SHA1 b503f4b80211cf1b8812ae62cc8086059f185be9
SHA512 5879f3dba37975d2f88768081a6c2670d540f1fca789e3a0893e5dfa1ade30ae418a82bcd51eb100d8ae4cebd95d26c963d9e1e2ca1d172824145b5eb80fc264
MD5 SHA1 SHA512

Submit Download

ctfmon.exe

Path C:\Users\Admin\Desktop\ctfmon.exe
Size 10KB
SHA256 171abacad96cd027317621fc8fb74aa3b8c13bf25eba79955b0e51bb90c6a843
MD5 29656b9e6b04c85e7bf4018b6844be28
SHA1 91e297712f7b8b72df83c83d59e897d492d5a5d1
SHA512 57d7bfd06da4d25091114d697f3de5d8b34ce38dc8d70968e0476771b176bd6e2bc60093b68ae53bcb306495254584e00663fcbee3b6a82b6ec633634fc97007
MD5 SHA1 SHA512

Submit Download

memory/1652-134-0x00000000052F0000-0x0000000005382000-memory.dmp

Download

memory/1652-130-0x00000000005D0000-0x0000000000682000-memory.dmp

Download

memory/1652-133-0x0000000005800000-0x0000000005DA4000-memory.dmp

Download

memory/1652-132-0x0000000073550000-0x00000000735D9000-memory.dmp

Download

memory/2308-141-0x0000000000700000-0x000000000079C000-memory.dmp

Download

memory/4512-143-0x0000000000400000-0x0000000000488000-memory.dmp

Download