wshrat | 58da9052c051b26987f32fc9bf831fed8a15eb3cf4ca9afd9f8473631ca3faa7

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97.js
Size 535KB
Sample230321-r5xshabe73
SHA256 852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97
MD5 c8f59af1220efa3761728c04ed23322a
SHA1 0e2d24b3e0ac2b2782b51cfe772b069268d514ed
SHA512 c1faf78277158ac4611bd996018959891b2e80a9e7fb40eafe962ee1a98d1ae0ea6977a450209d72c2242be007a55352832a066c6609c6e7458a24be4421ebbe
SSDEEP 384:t2WWKZWWAsg8gbToHWWWWWegHWWWWWztiGuYW+9j9suO5OOaCMOIYDr6LHDWTRtD:U8Y/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

http://chongmei33.publicvm.com:7045

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 12 IoCs

flow	pid	Process
22	4824	wscript.exe
24	4824	wscript.exe
25	4824	wscript.exe
30	4824	wscript.exe
38	4824	wscript.exe
59	4824	wscript.exe
60	4824	wscript.exe
69	4824	wscript.exe
71	4824	wscript.exe
84	4824	wscript.exe
94	4824	wscript.exe
106	4824	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97 = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97.js'"	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97 = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97.js'"	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 7 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	59	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/3/2023\|JavaScript
HTTP User-Agent header	69	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/3/2023\|JavaScript
HTTP User-Agent header	84	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/3/2023\|JavaScript
HTTP User-Agent header	106	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/3/2023\|JavaScript
HTTP User-Agent header	22	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/3/2023\|JavaScript
HTTP User-Agent header	24	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/3/2023\|JavaScript
HTTP User-Agent header	25	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/3/2023\|JavaScript

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97.js

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97.js
Size 535KB
SHA256 852a19d5d6da8e689f90f57ad0765f37f2e47fd89c718eb02af142d0d4de8e97
MD5 c8f59af1220efa3761728c04ed23322a
SHA1 0e2d24b3e0ac2b2782b51cfe772b069268d514ed
SHA512 c1faf78277158ac4611bd996018959891b2e80a9e7fb40eafe962ee1a98d1ae0ea6977a450209d72c2242be007a55352832a066c6609c6e7458a24be4421ebbe
SSDEEP 384:t2WWKZWWAsg8gbToHWWWWWegHWWWWWztiGuYW+9j9suO5OOaCMOIYDr6LHDWTRtD:U8Y/
MD5 SHA1 SHA512 SSDEEP

Submit Download