wshrat | 4854f4cdfc2cc56b7e62e3cb3503e4d2873207bd1dd99805f3c39a666a1473b5

General

Target

Payment Notification.js
Size

1009KB
MD5

e7fcc6eafeb8d232acb424cf11a72144
SHA1

4c16409adece66c53e8b1caf87f6bd6f30e611e8
SHA256

4854f4cdfc2cc56b7e62e3cb3503e4d2873207bd1dd99805f3c39a666a1473b5
SHA512

5e03618e89145435b49aaeaccb3b40886a44ecf752c8bf49a1284e8b2a647c7492199c8a2ad13c0393ae591d71f221c09ecd0e2be93b76a8fee6a29196128949
SSDEEP

3072:QQLlH0xKE8W8za9r6HLb6kyVIksLgu9M/z/SjANqyCCn50jPjSF:QQG

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

C2

http://harold.2waky.com:1604

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 25 IoCs

flow	pid	Process
4	760	wscript.exe
6	760	wscript.exe
7	760	wscript.exe
8	760	wscript.exe
10	760	wscript.exe
12	760	wscript.exe
13	760	wscript.exe
15	760	wscript.exe
16	760	wscript.exe
17	760	wscript.exe
19	760	wscript.exe
20	760	wscript.exe
21	760	wscript.exe
23	760	wscript.exe
24	760	wscript.exe
25	760	wscript.exe
27	760	wscript.exe
28	760	wscript.exe
29	760	wscript.exe
31	760	wscript.exe
32	760	wscript.exe
33	760	wscript.exe
35	760	wscript.exe
36	760	wscript.exe
37	760	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment Notification.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment Notification.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 24 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	37	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	15	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	17	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	21	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	23	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	24	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	36	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	12	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	25	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	27	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	32	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	33	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	10	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	13	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	16	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	28	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	35	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	31	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	6	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	7	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	8	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	19	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	20	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	29	WSHRAT\|106B36FF\|HVMHZIYD\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 760	1216	wscript.exe	29
PID 1216 wrote to memory of 760	1216	wscript.exe	29
PID 1216 wrote to memory of 760	1216	wscript.exe	29

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Payment Notification.js"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\Payment Notification.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment Notification.js

Filesize
1009KB

MD5
e7fcc6eafeb8d232acb424cf11a72144

SHA1
4c16409adece66c53e8b1caf87f6bd6f30e611e8

SHA256
4854f4cdfc2cc56b7e62e3cb3503e4d2873207bd1dd99805f3c39a666a1473b5

SHA512
5e03618e89145435b49aaeaccb3b40886a44ecf752c8bf49a1284e8b2a647c7492199c8a2ad13c0393ae591d71f221c09ecd0e2be93b76a8fee6a29196128949

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment Notification.js

Filesize
1009KB

MD5
e7fcc6eafeb8d232acb424cf11a72144

SHA1
4c16409adece66c53e8b1caf87f6bd6f30e611e8

SHA256
4854f4cdfc2cc56b7e62e3cb3503e4d2873207bd1dd99805f3c39a666a1473b5

SHA512
5e03618e89145435b49aaeaccb3b40886a44ecf752c8bf49a1284e8b2a647c7492199c8a2ad13c0393ae591d71f221c09ecd0e2be93b76a8fee6a29196128949

Download Submit
C:\Users\Admin\Payment Notification.js

Filesize
1009KB

MD5
e7fcc6eafeb8d232acb424cf11a72144

SHA1
4c16409adece66c53e8b1caf87f6bd6f30e611e8

SHA256
4854f4cdfc2cc56b7e62e3cb3503e4d2873207bd1dd99805f3c39a666a1473b5

SHA512
5e03618e89145435b49aaeaccb3b40886a44ecf752c8bf49a1284e8b2a647c7492199c8a2ad13c0393ae591d71f221c09ecd0e2be93b76a8fee6a29196128949

Download Submit

Analysis

Sharing