wshrat | 1254fb84cd8e21d3c712881f606cd36e8d068ad89b205da335614696bfc59ca3

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-05-2023 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Request For Quotation.js
Size

1.2MB
MD5

dca76785db3828884851b229738392e2
SHA1

d7687fe5780970e04849d142f7889391be73ed99
SHA256

1254fb84cd8e21d3c712881f606cd36e8d068ad89b205da335614696bfc59ca3
SHA512

30399033982b81aea21cab8c44739b053bb603c8b516e01ce1a1c6396004fd998dd01798d184259151de5217df9afc2b85e5ef2fa9711e6ec31f66a44ef2ab9c
SSDEEP

1536:QQ12UuLTs1CdS1nOsMokKleE73rnroY1YDEvMKfQXr6rsqTorsqTPs8Csn98uXOY:QQvo9S7xNJ0iIhQG9T

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

http://harold.2waky.com:3609

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 11 IoCs

flow	pid	Process
4	1144	wscript.exe
9	1144	wscript.exe
10	1144	wscript.exe
12	1144	wscript.exe
13	1144	wscript.exe
14	1144	wscript.exe
16	1144	wscript.exe
17	1144	wscript.exe
18	1144	wscript.exe
20	1144	wscript.exe
21	1144	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 9 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	13	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 16/5/2023\|JavaScript-v3.4\|01:Unknown
HTTP User-Agent header	14	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 16/5/2023\|JavaScript-v3.4\|01:Unknown
HTTP User-Agent header	16	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 16/5/2023\|JavaScript-v3.4\|01:Unknown
HTTP User-Agent header	17	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 16/5/2023\|JavaScript-v3.4\|01:Unknown
HTTP User-Agent header	20	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 16/5/2023\|JavaScript-v3.4\|01:Unknown
HTTP User-Agent header	9	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 16/5/2023\|JavaScript-v3.4\|01:Unknown
HTTP User-Agent header	12	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 16/5/2023\|JavaScript-v3.4\|01:Unknown
HTTP User-Agent header	18	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 16/5/2023\|JavaScript-v3.4\|01:Unknown
HTTP User-Agent header	10	WSHRAT\|F4C6D0E0\|WFSTZEPN\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 16/5/2023\|JavaScript-v3.4\|01:Unknown

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1144	1212	wscript.exe	29
PID 1212 wrote to memory of 1144	1212	wscript.exe	29
PID 1212 wrote to memory of 1144	1212	wscript.exe	29

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Request For Quotation.js"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Request For Quotation.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js

Filesize
1.2MB

MD5
dca76785db3828884851b229738392e2

SHA1
d7687fe5780970e04849d142f7889391be73ed99

SHA256
1254fb84cd8e21d3c712881f606cd36e8d068ad89b205da335614696bfc59ca3

SHA512
30399033982b81aea21cab8c44739b053bb603c8b516e01ce1a1c6396004fd998dd01798d184259151de5217df9afc2b85e5ef2fa9711e6ec31f66a44ef2ab9c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js

Filesize
1.2MB

MD5
dca76785db3828884851b229738392e2

SHA1
d7687fe5780970e04849d142f7889391be73ed99

SHA256
1254fb84cd8e21d3c712881f606cd36e8d068ad89b205da335614696bfc59ca3

SHA512
30399033982b81aea21cab8c44739b053bb603c8b516e01ce1a1c6396004fd998dd01798d184259151de5217df9afc2b85e5ef2fa9711e6ec31f66a44ef2ab9c

Download Submit
C:\Users\Admin\AppData\Roaming\Request For Quotation.js

Filesize
1.2MB

MD5
dca76785db3828884851b229738392e2

SHA1
d7687fe5780970e04849d142f7889391be73ed99

SHA256
1254fb84cd8e21d3c712881f606cd36e8d068ad89b205da335614696bfc59ca3

SHA512
30399033982b81aea21cab8c44739b053bb603c8b516e01ce1a1c6396004fd998dd01798d184259151de5217df9afc2b85e5ef2fa9711e6ec31f66a44ef2ab9c

Download Submit