wshrat | b03c3e78db7276e75dbb30b144d6dba8d417c25a59ea563c5691b5dbdc2b69e9

General

Target

04371699.vbs
Size

8KB
MD5

5c75f54e96d8ac97fa9644b0c8bac3d7
SHA1

668fef3a068cbbdf4c8fc4b81f3b81b4a671460e
SHA256

b03c3e78db7276e75dbb30b144d6dba8d417c25a59ea563c5691b5dbdc2b69e9
SHA512

d9eb586c09e3b05d6f35b20f56d4ebb3e4b80da490af0894a37d0388f406c819e66c5355297e0acbbe408b2066467e73bb801d360c8501afb975f1aaf868723a
SSDEEP

48:5AqkDUOQB6D8LD1QOFLDnw30Gwj0H6r5d3bCgDoB:IDLDuDVDdIgDe

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

C2

http://chongmei33.publicvm.com:7045

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 17 IoCs

flow	pid	Process
7	1176	WScript.exe
10	1176	WScript.exe
13	1176	WScript.exe
28	904	WScript.exe
45	904	WScript.exe
47	904	WScript.exe
59	904	WScript.exe
69	904	WScript.exe
72	904	WScript.exe
73	904	WScript.exe
74	904	WScript.exe
76	904	WScript.exe
86	904	WScript.exe
87	904	WScript.exe
88	904	WScript.exe
89	904	WScript.exe
90	904	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSYDSS.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSYDSS.js	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSYDSS = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\SSYDSS.js'"	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSYDSS = "wscript.exe //B 'C:\\Users\\Admin\\AppData\\Local\\Temp\\SSYDSS.js'"	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings	WScript.exe

Script User-Agent 10 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	87	WSHRAT\|A0A385EE\|LYVTYGSI\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/6/2023\|JavaScript
HTTP User-Agent header	89	WSHRAT\|A0A385EE\|LYVTYGSI\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/6/2023\|JavaScript
HTTP User-Agent header	69	WSHRAT\|A0A385EE\|LYVTYGSI\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/6/2023\|JavaScript
HTTP User-Agent header	86	WSHRAT\|A0A385EE\|LYVTYGSI\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/6/2023\|JavaScript
HTTP User-Agent header	72	WSHRAT\|A0A385EE\|LYVTYGSI\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/6/2023\|JavaScript
HTTP User-Agent header	73	WSHRAT\|A0A385EE\|LYVTYGSI\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/6/2023\|JavaScript
HTTP User-Agent header	88	WSHRAT\|A0A385EE\|LYVTYGSI\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/6/2023\|JavaScript
HTTP User-Agent header	90	WSHRAT\|A0A385EE\|LYVTYGSI\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/6/2023\|JavaScript
HTTP User-Agent header	28	WSHRAT\|A0A385EE\|LYVTYGSI\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/6/2023\|JavaScript
HTTP User-Agent header	45	WSHRAT\|A0A385EE\|LYVTYGSI\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 15/6/2023\|JavaScript

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 904	1176	WScript.exe	85
PID 1176 wrote to memory of 904	1176	WScript.exe	85

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04371699.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SSYDSS.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SSYDSS.js

Filesize
539KB

MD5
0284159948343867496533e56f590b4f

SHA1
bc30c2ad6e4c4cc8f931f0b19891a34eab65b06b

SHA256
3579c1346320ede28d523e6074c0729d2ae8e64e8e7983161097e733b259a7fd

SHA512
1473b7b562f05268ad8b97b713a7b77f7fa9de289ba33d31d3bdadd19f37e9d2e1eccc127ffba44b08c4cd6f87230d67b6ce35aee2a1d291d8e9e960af785882

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSYDSS.js

Filesize
539KB

MD5
0284159948343867496533e56f590b4f

SHA1
bc30c2ad6e4c4cc8f931f0b19891a34eab65b06b

SHA256
3579c1346320ede28d523e6074c0729d2ae8e64e8e7983161097e733b259a7fd

SHA512
1473b7b562f05268ad8b97b713a7b77f7fa9de289ba33d31d3bdadd19f37e9d2e1eccc127ffba44b08c4cd6f87230d67b6ce35aee2a1d291d8e9e960af785882

Download Submit

Analysis

Sharing