wshrat | b32f3e7d67e21bf2d40dec620a6f2a1b471847af427f924ed28b72633b9b6c40

General

Target

05212023840.js
Size

1.0MB
MD5

9ccea994750b4d63ec5ef4a705f4855e
SHA1

334b5f78ce8d2a73fdb551acd389991552c39b3b
SHA256

b32f3e7d67e21bf2d40dec620a6f2a1b471847af427f924ed28b72633b9b6c40
SHA512

736c4ad5122bf6da2cb3adedebeea007f39f707b661f651114ea08cf33521c916e1a802701f4ea1e71767e78f913ddd0b01cfeb97b407a8a2b20d2e4c6f5079c
SSDEEP

3072:Cm0EaAcTqGaSqBHJZieEDQjb98Ztp8i8Jkzh:Cm0EaAcTqGaSqBHJZutUGzh

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

C2

http://45.90.222.125:7121

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 19 IoCs

flow	pid	Process
6	1668	wscript.exe
9	4740	wscript.exe
17	4740	wscript.exe
19	4740	wscript.exe
27	4740	wscript.exe
28	4740	wscript.exe
31	4740	wscript.exe
38	4740	wscript.exe
40	4740	wscript.exe
50	4740	wscript.exe
51	4740	wscript.exe
54	4740	wscript.exe
55	4740	wscript.exe
58	4740	wscript.exe
67	4740	wscript.exe
68	4740	wscript.exe
69	4740	wscript.exe
70	4740	wscript.exe
71	4740	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05212023840.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05212023840.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\05212023840 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\05212023840.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\05212023840 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\05212023840.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\05212023840 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\05212023840.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\05212023840 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\05212023840.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\software\microsoft\windows\currentversion\run	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 15 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	38	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	71	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	55	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	69	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	70	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	19	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	50	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	40	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	68	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	58	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	27	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	28	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	54	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 22/5/2023\|JavaScript-v3.4\|IN:India

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 4740	1668	wscript.exe	84
PID 1668 wrote to memory of 4740	1668	wscript.exe	84

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\05212023840.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\05212023840.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:4740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\05212023840.js

Filesize
1.0MB

MD5
9ccea994750b4d63ec5ef4a705f4855e

SHA1
334b5f78ce8d2a73fdb551acd389991552c39b3b

SHA256
b32f3e7d67e21bf2d40dec620a6f2a1b471847af427f924ed28b72633b9b6c40

SHA512
736c4ad5122bf6da2cb3adedebeea007f39f707b661f651114ea08cf33521c916e1a802701f4ea1e71767e78f913ddd0b01cfeb97b407a8a2b20d2e4c6f5079c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05212023840.js

Filesize
64KB

MD5
fcd6bcb56c1689fcef28b57c22475bad

SHA1
1adc95bebe9eea8c112d40cd04ab7a8d75c4f961

SHA256
de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31

SHA512
73e4153936dab198397b74ee9efc26093dda721eaab2f8d92786891153b45b04265a161b169c988edb0db2c53124607b6eaaa816559c5ce54f3dbc9fa6a7a4b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05212023840.js

Filesize
1.0MB

MD5
9ccea994750b4d63ec5ef4a705f4855e

SHA1
334b5f78ce8d2a73fdb551acd389991552c39b3b

SHA256
b32f3e7d67e21bf2d40dec620a6f2a1b471847af427f924ed28b72633b9b6c40

SHA512
736c4ad5122bf6da2cb3adedebeea007f39f707b661f651114ea08cf33521c916e1a802701f4ea1e71767e78f913ddd0b01cfeb97b407a8a2b20d2e4c6f5079c

Download Submit

Analysis

Sharing