wshrat | f2fb70e9f299fc61f65c13c40c3094c4e9b58d4e1f8af7e75e2d030d586eee9c

General

Target

PAYMENT SETTLEMENT.vbs
Size

240KB
MD5

c0526db1f0ccb70c709d23c044329e0b
SHA1

fe1672dc2aa4095d57ae670b9ba28804f7e4faaa
SHA256

f2fb70e9f299fc61f65c13c40c3094c4e9b58d4e1f8af7e75e2d030d586eee9c
SHA512

0d9ff14a9db9a8c61b1207deada2a93373866c45a9a80ee9287cb324524a6155ccafd85a62a80329a7feb415aa72b5f729804bd4ff841049b751c85813f26dc4
SSDEEP

6144:/hwQdksTNeDQOsc7PqKz26fqCPR1FZm/B8HXCllgyI+v:VdxUQ2JagqCP0eywhY

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

C2

http://0b3c.duckdns.org:1988

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 11 IoCs

flow	pid	Process
4	3788	wscript.exe
12	3788	wscript.exe
16	3788	wscript.exe
17	3788	wscript.exe
24	3788	wscript.exe
27	3788	wscript.exe
37	3788	wscript.exe
52	3788	wscript.exe
53	3788	wscript.exe
54	3788	wscript.exe
55	3788	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PAYMENT SETTLEMENT.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PAYMENT SETTLEMENT.vbs	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PAYMENT SETTLEMENT = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PAYMENT SETTLEMENT.vbs\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PAYMENT SETTLEMENT = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PAYMENT SETTLEMENT.vbs\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PAYMENT SETTLEMENT = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PAYMENT SETTLEMENT.vbs\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PAYMENT SETTLEMENT = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PAYMENT SETTLEMENT.vbs\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1052	1056	WScript.exe	81
PID 1056 wrote to memory of 1052	1056	WScript.exe	81
PID 1056 wrote to memory of 3788	1056	WScript.exe	82
PID 1056 wrote to memory of 3788	1056	WScript.exe	82
PID 3788 wrote to memory of 2052	3788	wscript.exe	83
PID 3788 wrote to memory of 2052	3788	wscript.exe	83

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PAYMENT SETTLEMENT.vbs"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BwQRZzEAzr.vbs"
  2⤵
  PID:1052
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PAYMENT SETTLEMENT.vbs"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BwQRZzEAzr.vbs"
    3⤵
    PID:2052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BwQRZzEAzr.vbs

Filesize
1KB

MD5
3df35da081f5c18c2e2c7491cf83dc5f

SHA1
78ad3a5f1c78798cee08c2cd9cb2b22621ef2620

SHA256
045369096a68226d83915b9e5cab0476f7d9b876647d2e423d31b83d64e9dd0f

SHA512
2181482aa98f7149939cb73e53756b700dca722d6c958c3d3f82e902f5b456b9a770d8f619f1cf43d74768746192e9ab40b92f449599364f47d88307c783b0a3

Download Submit
C:\Users\Admin\AppData\Roaming\BwQRZzEAzr.vbs

Filesize
1KB

MD5
3df35da081f5c18c2e2c7491cf83dc5f

SHA1
78ad3a5f1c78798cee08c2cd9cb2b22621ef2620

SHA256
045369096a68226d83915b9e5cab0476f7d9b876647d2e423d31b83d64e9dd0f

SHA512
2181482aa98f7149939cb73e53756b700dca722d6c958c3d3f82e902f5b456b9a770d8f619f1cf43d74768746192e9ab40b92f449599364f47d88307c783b0a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PAYMENT SETTLEMENT.vbs

Filesize
240KB

MD5
c0526db1f0ccb70c709d23c044329e0b

SHA1
fe1672dc2aa4095d57ae670b9ba28804f7e4faaa

SHA256
f2fb70e9f299fc61f65c13c40c3094c4e9b58d4e1f8af7e75e2d030d586eee9c

SHA512
0d9ff14a9db9a8c61b1207deada2a93373866c45a9a80ee9287cb324524a6155ccafd85a62a80329a7feb415aa72b5f729804bd4ff841049b751c85813f26dc4

Download Submit
C:\Users\Admin\AppData\Roaming\PAYMENT SETTLEMENT.vbs

Filesize
240KB

MD5
c0526db1f0ccb70c709d23c044329e0b

SHA1
fe1672dc2aa4095d57ae670b9ba28804f7e4faaa

SHA256
f2fb70e9f299fc61f65c13c40c3094c4e9b58d4e1f8af7e75e2d030d586eee9c

SHA512
0d9ff14a9db9a8c61b1207deada2a93373866c45a9a80ee9287cb324524a6155ccafd85a62a80329a7feb415aa72b5f729804bd4ff841049b751c85813f26dc4

Download Submit

Analysis

Sharing