wshrat | 339a06ea8d91b3663bda121ecb5f027eb047f2c547cff834bc7de1c04eea00e5

Analysis

max time kernel
132s
max time network
145s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07-05-2023 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER-230428.js
Size

521KB
MD5

678f7bc2963dfe7d00f80de5132f63af
SHA1

b2f9383257887b902b25c7f24e1d6320cb88acea
SHA256

749508570fded7091e235707bd3a1f72c64c2428802abafaa98c47ce970c8df6
SHA512

9fc216681d1e1979cafd33b8c41f116dc99f0e859dd87ed2340e1d3609efc0f302c7c2215500f3bafc3f5b45003898facc55e0fd5c4c7f0097da04977abcb777
SSDEEP

384:lilWWgNgxgygHWWWWW/IHWWWWWXgHBq8iOAwI4LuRu1kKMiIeBWSPSHv7rWektWW:d1H0Ef

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

http://chongmei33.publicvm.com:7045

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 16 IoCs

flow	pid	Process
4	1124	wscript.exe
5	1124	wscript.exe
6	1124	wscript.exe
10	1124	wscript.exe
12	1124	wscript.exe
13	1124	wscript.exe
14	1124	wscript.exe
16	1124	wscript.exe
17	1124	wscript.exe
18	1124	wscript.exe
20	1124	wscript.exe
21	1124	wscript.exe
22	1124	wscript.exe
23	1124	wscript.exe
25	1124	wscript.exe
26	1124	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER-230428.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER-230428.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ORDER-230428 = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\ORDER-230428.js'"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows\CurrentVersion\Run\ORDER-230428 = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\ORDER-230428.js'"	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 13 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	14	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	17	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	18	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	4	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	5	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	10	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	12	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	13	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	16	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	20	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	21	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	23	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	25	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 8/5/2023\|JavaScript

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ORDER-230428.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER-230428.js

Filesize
521KB

MD5
678f7bc2963dfe7d00f80de5132f63af

SHA1
b2f9383257887b902b25c7f24e1d6320cb88acea

SHA256
749508570fded7091e235707bd3a1f72c64c2428802abafaa98c47ce970c8df6

SHA512
9fc216681d1e1979cafd33b8c41f116dc99f0e859dd87ed2340e1d3609efc0f302c7c2215500f3bafc3f5b45003898facc55e0fd5c4c7f0097da04977abcb777

Download Submit