wshrat | 699fdfbf624be71c9c2b36081e22209aa7ad96dd5cedaf6fc0fcb1fd37720c1f

General

Target

8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b.js
Size

1.1MB
MD5

0a72d138c339bdb349da3c3311ba42d9
SHA1

39d2a2aa91b20890b205e3afbfa6998316264ad9
SHA256

8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b
SHA512

a51616d35b40731d825ea1ca6900f68cc3add16594f0aa63a565afdd3a756165c86aad3b52363352d7118ef7cc071c0255517837de9397ab8f447ea8f3b539e8
SSDEEP

6144:MQJzmNEfYck5GmLcmSmA3ntOsAZelVWGNODAVnBk5ogYgtsY52PyeeZ4w5QVaQUU:X/7

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

C2

http://harold.2waky.com:3609

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 10 IoCs

flow	pid	Process
4	1628	wscript.exe
6	1628	wscript.exe
7	1628	wscript.exe
9	1628	wscript.exe
11	1628	wscript.exe
12	1628	wscript.exe
13	1628	wscript.exe
15	1628	wscript.exe
16	1628	wscript.exe
17	1628	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 9 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	7	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	11	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	16	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	17	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	9	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	12	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	13	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	15	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/4/2023\|JavaScript-v3.4\|IN:India

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1628	1476	wscript.exe	29
PID 1476 wrote to memory of 1628	1476	wscript.exe	29
PID 1476 wrote to memory of 1628	1476	wscript.exe	29

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b.js
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b.js

Filesize
1.1MB

MD5
0a72d138c339bdb349da3c3311ba42d9

SHA1
39d2a2aa91b20890b205e3afbfa6998316264ad9

SHA256
8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b

SHA512
a51616d35b40731d825ea1ca6900f68cc3add16594f0aa63a565afdd3a756165c86aad3b52363352d7118ef7cc071c0255517837de9397ab8f447ea8f3b539e8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b.js

Filesize
1.1MB

MD5
0a72d138c339bdb349da3c3311ba42d9

SHA1
39d2a2aa91b20890b205e3afbfa6998316264ad9

SHA256
8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b

SHA512
a51616d35b40731d825ea1ca6900f68cc3add16594f0aa63a565afdd3a756165c86aad3b52363352d7118ef7cc071c0255517837de9397ab8f447ea8f3b539e8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b.js

Filesize
1.1MB

MD5
0a72d138c339bdb349da3c3311ba42d9

SHA1
39d2a2aa91b20890b205e3afbfa6998316264ad9

SHA256
8430808dd1aed6da9483dfe4c24a6747b65d3b542b407f462358c42a6a423e3b

SHA512
a51616d35b40731d825ea1ca6900f68cc3add16594f0aa63a565afdd3a756165c86aad3b52363352d7118ef7cc071c0255517837de9397ab8f447ea8f3b539e8

Download Submit

Analysis

Sharing