wshrat | 339a06ea8d91b3663bda121ecb5f027eb047f2c547cff834bc7de1c04eea00e5

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2023 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER-230428.js
Size

521KB
MD5

678f7bc2963dfe7d00f80de5132f63af
SHA1

b2f9383257887b902b25c7f24e1d6320cb88acea
SHA256

749508570fded7091e235707bd3a1f72c64c2428802abafaa98c47ce970c8df6
SHA512

9fc216681d1e1979cafd33b8c41f116dc99f0e859dd87ed2340e1d3609efc0f302c7c2215500f3bafc3f5b45003898facc55e0fd5c4c7f0097da04977abcb777
SSDEEP

384:lilWWgNgxgygHWWWWW/IHWWWWWXgHBq8iOAwI4LuRu1kKMiIeBWSPSHv7rWektWW:d1H0Ef

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

http://chongmei33.publicvm.com:7045

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 14 IoCs

flow	pid	Process
9	2068	wscript.exe
14	2068	wscript.exe
16	2068	wscript.exe
18	2068	wscript.exe
25	2068	wscript.exe
32	2068	wscript.exe
34	2068	wscript.exe
45	2068	wscript.exe
50	2068	wscript.exe
51	2068	wscript.exe
53	2068	wscript.exe
57	2068	wscript.exe
62	2068	wscript.exe
63	2068	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER-230428.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER-230428.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ORDER-230428 = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\ORDER-230428.js'"	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ORDER-230428 = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\ORDER-230428.js'"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\software\microsoft\windows\currentversion\run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 10 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	63	WSHRAT\|A0674C6B\|UXINIZSV\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	16	WSHRAT\|A0674C6B\|UXINIZSV\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	25	WSHRAT\|A0674C6B\|UXINIZSV\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	45	WSHRAT\|A0674C6B\|UXINIZSV\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	50	WSHRAT\|A0674C6B\|UXINIZSV\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	51	WSHRAT\|A0674C6B\|UXINIZSV\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	14	WSHRAT\|A0674C6B\|UXINIZSV\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	18	WSHRAT\|A0674C6B\|UXINIZSV\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	32	WSHRAT\|A0674C6B\|UXINIZSV\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 8/5/2023\|JavaScript
HTTP User-Agent header	62	WSHRAT\|A0674C6B\|UXINIZSV\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 8/5/2023\|JavaScript

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ORDER-230428.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER-230428.js

Filesize
521KB

MD5
678f7bc2963dfe7d00f80de5132f63af

SHA1
b2f9383257887b902b25c7f24e1d6320cb88acea

SHA256
749508570fded7091e235707bd3a1f72c64c2428802abafaa98c47ce970c8df6

SHA512
9fc216681d1e1979cafd33b8c41f116dc99f0e859dd87ed2340e1d3609efc0f302c7c2215500f3bafc3f5b45003898facc55e0fd5c4c7f0097da04977abcb777

Download Submit