wshrat | ef75121bade3a31c981d6086a09633a2965380f954e6496c491e21d27c7dabc1

General

Target

37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js
Size

983KB
MD5

bcf2d9bfddeec58c7adfb7b85a6b179e
SHA1

bf7c734f61cf2138932782a4a7c4873084168082
SHA256

37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657
SHA512

34d3819a269e254df91355df35d871b76577f0067275f2aac18c34a76913c08b7fe1b4a434e8b444e13253a4dbed4984dfe40a85803e218fd5d4c0866072be0b
SSDEEP

6144:QQa4dEoQA8gY1J3H2gzGs/f99tz/NpjQiVAOB199LWqm0amhAuP+jLCHw7oIncrX:TVk

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

C2

http://harold.2waky.com:1604

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 23 IoCs

flow	pid	Process
10	2104	wscript.exe
12	2104	wscript.exe
28	2104	wscript.exe
33	2104	wscript.exe
39	2104	wscript.exe
41	2104	wscript.exe
43	2104	wscript.exe
46	2104	wscript.exe
47	2104	wscript.exe
52	2104	wscript.exe
56	2104	wscript.exe
57	2104	wscript.exe
61	2104	wscript.exe
64	2104	wscript.exe
65	2104	wscript.exe
67	2104	wscript.exe
69	2104	wscript.exe
70	2104	wscript.exe
72	2104	wscript.exe
73	2104	wscript.exe
75	2104	wscript.exe
77	2104	wscript.exe
78	2104	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 22 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	70	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	72	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	73	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	41	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	43	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	67	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	56	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	64	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	75	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	78	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	28	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	47	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	52	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	77	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	12	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	33	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	69	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	61	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	65	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	39	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	46	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	57	WSHRAT\|924C16C7\|OZADSVWH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 19/5/2023\|JavaScript-v3.4\|IN:India

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2104	4868	wscript.exe	84
PID 4868 wrote to memory of 2104	4868	wscript.exe	84

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:2104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js

Filesize
983KB

MD5
bcf2d9bfddeec58c7adfb7b85a6b179e

SHA1
bf7c734f61cf2138932782a4a7c4873084168082

SHA256
37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657

SHA512
34d3819a269e254df91355df35d871b76577f0067275f2aac18c34a76913c08b7fe1b4a434e8b444e13253a4dbed4984dfe40a85803e218fd5d4c0866072be0b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js

Filesize
983KB

MD5
bcf2d9bfddeec58c7adfb7b85a6b179e

SHA1
bf7c734f61cf2138932782a4a7c4873084168082

SHA256
37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657

SHA512
34d3819a269e254df91355df35d871b76577f0067275f2aac18c34a76913c08b7fe1b4a434e8b444e13253a4dbed4984dfe40a85803e218fd5d4c0866072be0b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657.js

Filesize
983KB

MD5
bcf2d9bfddeec58c7adfb7b85a6b179e

SHA1
bf7c734f61cf2138932782a4a7c4873084168082

SHA256
37c5330acc675d94efd73294e5e3942362437c611a6fc39ca19b6a8fd4afb657

SHA512
34d3819a269e254df91355df35d871b76577f0067275f2aac18c34a76913c08b7fe1b4a434e8b444e13253a4dbed4984dfe40a85803e218fd5d4c0866072be0b

Download Submit

Analysis

Sharing