wshrat | df018cc7e708b47edfe4f39769058ce0ba10a65fe653d3a32412dd504d3f2028

General

Target

Tax Returns of R48,765.js
Size

957KB
MD5

0f597e6821a29bc87b36222f08eff311
SHA1

e7f24cd04de9b92c013d71d3de526461cfb33c91
SHA256

df018cc7e708b47edfe4f39769058ce0ba10a65fe653d3a32412dd504d3f2028
SHA512

693ed1331f7f048789c11bc661949519149c43e3a76b3b600a1990f74763500a6b4a5efb532921bcdb58b27f3a136af9ba63e2e1dce4094fe078076d0073f1a7
SSDEEP

6144:QQ5C90ha3hcY0c5OyZD5i8frkU+uKCbbBGZs3xh527wIy+6Y16vLKdYoiAL1Xl4R:TKF

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

C2

http://harold.2waky.com:3609

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 13 IoCs

flow	pid	Process
4	320	wscript.exe
6	320	wscript.exe
7	320	wscript.exe
9	320	wscript.exe
11	320	wscript.exe
12	320	wscript.exe
13	320	wscript.exe
15	320	wscript.exe
16	320	wscript.exe
17	320	wscript.exe
19	320	wscript.exe
20	320	wscript.exe
21	320	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns of R48,765.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns of R48,765.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 12 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	9	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	11	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	12	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	15	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	20	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	21	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	6	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	13	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	16	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	17	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	19	WSHRAT\|9CA37D4D\|YBHADZIG\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/4/2023\|JavaScript-v3.4\|IN:India

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 320	1696	wscript.exe	28
PID 1696 wrote to memory of 320	1696	wscript.exe	28
PID 1696 wrote to memory of 320	1696	wscript.exe	28

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Tax Returns of R48,765.js"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Tax Returns of R48,765.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns of R48,765.js

Filesize
957KB

MD5
0f597e6821a29bc87b36222f08eff311

SHA1
e7f24cd04de9b92c013d71d3de526461cfb33c91

SHA256
df018cc7e708b47edfe4f39769058ce0ba10a65fe653d3a32412dd504d3f2028

SHA512
693ed1331f7f048789c11bc661949519149c43e3a76b3b600a1990f74763500a6b4a5efb532921bcdb58b27f3a136af9ba63e2e1dce4094fe078076d0073f1a7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns of R48,765.js

Filesize
957KB

MD5
0f597e6821a29bc87b36222f08eff311

SHA1
e7f24cd04de9b92c013d71d3de526461cfb33c91

SHA256
df018cc7e708b47edfe4f39769058ce0ba10a65fe653d3a32412dd504d3f2028

SHA512
693ed1331f7f048789c11bc661949519149c43e3a76b3b600a1990f74763500a6b4a5efb532921bcdb58b27f3a136af9ba63e2e1dce4094fe078076d0073f1a7

Download Submit
C:\Users\Admin\AppData\Roaming\Tax Returns of R48,765.js

Filesize
957KB

MD5
0f597e6821a29bc87b36222f08eff311

SHA1
e7f24cd04de9b92c013d71d3de526461cfb33c91

SHA256
df018cc7e708b47edfe4f39769058ce0ba10a65fe653d3a32412dd504d3f2028

SHA512
693ed1331f7f048789c11bc661949519149c43e3a76b3b600a1990f74763500a6b4a5efb532921bcdb58b27f3a136af9ba63e2e1dce4094fe078076d0073f1a7

Download Submit

Analysis

Sharing