wshrat | f3309d927d3fda9e341efc21665b696ce01eb4548938c9e53ccef218e8cf5ba3

Analysis

max time kernel
138s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2023, 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO102983459pdf.js
Size

188KB
MD5

bc83816244612cf692c88784bf39314e
SHA1

f2b0aebbf7668f78344bcf2c5c6c739b0bdb4152
SHA256

f6cf56fadb9bc380881e8d653e2a9cbca6dd145d66b24b5d61fc8769fb45f12e
SHA512

a552a667c39799f391501bf8419a15147ed2d692543903f1c718ac38a51d89012cc2739be2c6539a06bab1813f5ef7b94782bb87fb18fbbf928a0f835b667e98
SSDEEP

3072:KyBsgQF1zZbbURCftbIpklgVDSxGfmuZnh6csQkFAQ0bamxvEzseGK/6H:KyBvQFIRCNAklgF2GuuZn+JMDreGK2

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

http://email15ssoscure.mydad.info:7123

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 7 IoCs

flow	pid	Process
5	1088	wscript.exe
9	1088	wscript.exe
39	1088	wscript.exe
92	1088	wscript.exe
96	1088	wscript.exe
99	1088	wscript.exe
100	1088	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO102983459pdf.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO102983459pdf.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO102983459pdf = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO102983459pdf.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO102983459pdf = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO102983459pdf.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	99	WSHRAT\|18024990\|TMKNGOMU\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 12/1/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	100	WSHRAT\|18024990\|TMKNGOMU\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 12/1/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	9	WSHRAT\|18024990\|TMKNGOMU\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 12/1/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	39	WSHRAT\|18024990\|TMKNGOMU\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 12/1/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	92	WSHRAT\|18024990\|TMKNGOMU\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 12/1/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	96	WSHRAT\|18024990\|TMKNGOMU\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 12/1/2023\|JavaScript-v3.4\|NL:Netherlands

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO102983459pdf.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads