wshrat | cbe7d5663fd5359a72f88e44d083703d9625235929c31e0f5b16a0b42cb44d35

General

Target

Tax Returns of R58,765.js
Size

1.0MB
MD5

33300fb747c6677625aa17d03e1010f3
SHA1

b1bea456907b59a8182a0f01cc0e90f6e32e2779
SHA256

cbe7d5663fd5359a72f88e44d083703d9625235929c31e0f5b16a0b42cb44d35
SHA512

3c7af332da0a394354b0f3245a7677149ea63bdb5e6b5fcbd7fe984d338c1cecb7e299e127859c1dafc4bf199d3d8c3923d2c32213ab292ccc7aa42558b65764
SSDEEP

6144:QQ7vErztQ9MZIUWrltWZV1+VJaMd5KVPb5emOJ62+ILfahP2CTLqO0EXZ9gsP7Ay:Te

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

C2

http://harold.2waky.com:3609

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 13 IoCs

flow	pid	Process
4	2904	wscript.exe
6	2904	wscript.exe
8	2904	wscript.exe
9	2904	wscript.exe
11	2904	wscript.exe
12	2904	wscript.exe
13	2904	wscript.exe
15	2904	wscript.exe
16	2904	wscript.exe
17	2904	wscript.exe
19	2904	wscript.exe
20	2904	wscript.exe
23	2904	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns of R58,765.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns of R58,765.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 10 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	15	WSHRAT\|A818061C\|UMAXQRGK\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	16	WSHRAT\|A818061C\|UMAXQRGK\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	19	WSHRAT\|A818061C\|UMAXQRGK\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	8	WSHRAT\|A818061C\|UMAXQRGK\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	11	WSHRAT\|A818061C\|UMAXQRGK\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	13	WSHRAT\|A818061C\|UMAXQRGK\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	17	WSHRAT\|A818061C\|UMAXQRGK\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	6	WSHRAT\|A818061C\|UMAXQRGK\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	9	WSHRAT\|A818061C\|UMAXQRGK\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	12	WSHRAT\|A818061C\|UMAXQRGK\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 19/7/2023\|JavaScript-v3.4\|NL:Netherlands

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2904	2372	wscript.exe	29
PID 2372 wrote to memory of 2904	2372	wscript.exe	29
PID 2372 wrote to memory of 2904	2372	wscript.exe	29

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Tax Returns of R58,765.js"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Tax Returns of R58,765.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:2904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns of R58,765.js

Filesize
1.0MB

MD5
33300fb747c6677625aa17d03e1010f3

SHA1
b1bea456907b59a8182a0f01cc0e90f6e32e2779

SHA256
cbe7d5663fd5359a72f88e44d083703d9625235929c31e0f5b16a0b42cb44d35

SHA512
3c7af332da0a394354b0f3245a7677149ea63bdb5e6b5fcbd7fe984d338c1cecb7e299e127859c1dafc4bf199d3d8c3923d2c32213ab292ccc7aa42558b65764

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns of R58,765.js

Filesize
1.0MB

MD5
33300fb747c6677625aa17d03e1010f3

SHA1
b1bea456907b59a8182a0f01cc0e90f6e32e2779

SHA256
cbe7d5663fd5359a72f88e44d083703d9625235929c31e0f5b16a0b42cb44d35

SHA512
3c7af332da0a394354b0f3245a7677149ea63bdb5e6b5fcbd7fe984d338c1cecb7e299e127859c1dafc4bf199d3d8c3923d2c32213ab292ccc7aa42558b65764

Download Submit
C:\Users\Admin\AppData\Roaming\Tax Returns of R58,765.js

Filesize
1.0MB

MD5
33300fb747c6677625aa17d03e1010f3

SHA1
b1bea456907b59a8182a0f01cc0e90f6e32e2779

SHA256
cbe7d5663fd5359a72f88e44d083703d9625235929c31e0f5b16a0b42cb44d35

SHA512
3c7af332da0a394354b0f3245a7677149ea63bdb5e6b5fcbd7fe984d338c1cecb7e299e127859c1dafc4bf199d3d8c3923d2c32213ab292ccc7aa42558b65764

Download Submit

Analysis

Sharing