wshrat | 1ec7ad836a312f391472faa915731b5080e213429578747c899a0af1c6b03490

General

Target
Confirmation transfer Copy MT103 10102426.js
Size 33KB
Sample220913-pxaa5abddk
SHA256 1ec7ad836a312f391472faa915731b5080e213429578747c899a0af1c6b03490
MD5 c98420f2a645134717596481defdf4db
SHA1 f891d95fe18a323647dc497b8939e8a8dab6d1c2
SHA512 5186eb33d4fca238fbcc87bbb8e0a8456d8edbb38d1062022c6eaca9e50bde0eae3993bf23b939c77ad5bc6b4b648102db5519abdb056def1f0f6411930ff465
SSDEEP 768:yQXoyfETBo8AV1gxEfCnml3IbU4i8lx7ABX8TvGLHG:HfETK8AV1cE8ml3IbLiKx7GX8R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

C2

http://fresh01.ddns.net:2256

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	4304	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Confirmation transfer Copy MT103 10102426.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Confirmation transfer Copy MT103 10102426.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Confirmation transfer Copy MT103 10102426 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Confirmation transfer Copy MT103 10102426.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Confirmation transfer Copy MT103 10102426 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Confirmation transfer Copy MT103 10102426.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Confirmation transfer Copy MT103 10102426 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Confirmation transfer Copy MT103 10102426.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Confirmation transfer Copy MT103 10102426 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Confirmation transfer Copy MT103 10102426.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	5	WSHRAT\|36F4858E\|IYMUGYHL\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 13/9/2022\|JavaScript

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 4392	1840	wscript.exe	84
PID 1840 wrote to memory of 4392	1840	wscript.exe	84
PID 1840 wrote to memory of 4304	1840	wscript.exe	85
PID 1840 wrote to memory of 4304	1840	wscript.exe	85
PID 4304 wrote to memory of 1136	4304	wscript.exe	86
PID 4304 wrote to memory of 1136	4304	wscript.exe	86

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Confirmation transfer Copy MT103 10102426.js"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\CCtFJhcxTe.js"
  2⤵
  PID:4392
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Confirmation transfer Copy MT103 10102426.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\CCtFJhcxTe.js"
    3⤵
    PID:1136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CCtFJhcxTe.js

Path C:\Users\Admin\AppData\Roaming\CCtFJhcxTe.js
Size 2KB
SHA256 e54606bf30f54e0468859e76e7adc938a81fce0918fe5bb8985ee1c6dd7054e5
MD5 d2d382231adecca9cc69dfedcd9e8883
SHA1 528472ab356aeb58a3c74fff37da166e82f183f5
SHA512 bab130bb27ceb3d77ef5be58ab7ed554ac4d641335c0d96a77aef2ddb4929e52937762e48f9f644fa49080deaa1dfbff4d3701ab78a12bd3694e5d4b46e21016
MD5 SHA1 SHA512

Submit Download

CCtFJhcxTe.js

Path C:\Users\Admin\AppData\Roaming\CCtFJhcxTe.js
Size 2KB
SHA256 e54606bf30f54e0468859e76e7adc938a81fce0918fe5bb8985ee1c6dd7054e5
MD5 d2d382231adecca9cc69dfedcd9e8883
SHA1 528472ab356aeb58a3c74fff37da166e82f183f5
SHA512 bab130bb27ceb3d77ef5be58ab7ed554ac4d641335c0d96a77aef2ddb4929e52937762e48f9f644fa49080deaa1dfbff4d3701ab78a12bd3694e5d4b46e21016
MD5 SHA1 SHA512

Submit Download

Confirmation transfer Copy MT103 10102426.js

Path C:\Users\Admin\AppData\Roaming\Confirmation transfer Copy MT103 10102426.js
Size 33KB
SHA256 1ec7ad836a312f391472faa915731b5080e213429578747c899a0af1c6b03490
MD5 c98420f2a645134717596481defdf4db
SHA1 f891d95fe18a323647dc497b8939e8a8dab6d1c2
SHA512 5186eb33d4fca238fbcc87bbb8e0a8456d8edbb38d1062022c6eaca9e50bde0eae3993bf23b939c77ad5bc6b4b648102db5519abdb056def1f0f6411930ff465
SSDEEP 768:yQXoyfETBo8AV1gxEfCnml3IbU4i8lx7ABX8TvGLHG:HfETK8AV1cE8ml3IbLiKx7GX8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Confirmation transfer Copy MT103 10102426.js

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Confirmation transfer Copy MT103 10102426.js
Size 33KB
SHA256 1ec7ad836a312f391472faa915731b5080e213429578747c899a0af1c6b03490
MD5 c98420f2a645134717596481defdf4db
SHA1 f891d95fe18a323647dc497b8939e8a8dab6d1c2
SHA512 5186eb33d4fca238fbcc87bbb8e0a8456d8edbb38d1062022c6eaca9e50bde0eae3993bf23b939c77ad5bc6b4b648102db5519abdb056def1f0f6411930ff465
SSDEEP 768:yQXoyfETBo8AV1gxEfCnml3IbU4i8lx7ABX8TvGLHG:HfETK8AV1cE8ml3IbLiKx7GX8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads