wshrat | 8cae71910574fa96fdf20ddab8897e90d155e50036ddb2f3d033a7b13a45b90f

General

Target

Request For Quotation.js
Size

926KB
MD5

d88e96b01cbe12a5dbaefd28ccfcc7dc
SHA1

d1c01512b187176428440463eaae7b7d5be2aabf
SHA256

8cae71910574fa96fdf20ddab8897e90d155e50036ddb2f3d033a7b13a45b90f
SHA512

1dc22521994a390b97ad7e7880f1812b865a22b5c5681bacc3870f37baae37f2772e071f68a6a7b1669664f2c00d0f7c96d8815601bdcef69c43d008da348388
SSDEEP

6144:QQbl/QgzB5SMaGRnxrga5gxa17U7ck9d8JDr+DNgMPiColqGYXY/i/Dz9rcgVfEn:TNLfp

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

C2

http://harold.2waky.com:3609

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 15 IoCs

flow	pid	Process
18	1584	wscript.exe
20	1584	wscript.exe
25	1584	wscript.exe
32	1584	wscript.exe
43	1584	wscript.exe
44	1584	wscript.exe
45	1584	wscript.exe
49	1584	wscript.exe
53	1584	wscript.exe
57	1584	wscript.exe
58	1584	wscript.exe
71	1584	wscript.exe
72	1584	wscript.exe
73	1584	wscript.exe
78	1584	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 14 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	78	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	57	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	72	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	58	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	25	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	49	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	53	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	71	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	73	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	20	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	45	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	44	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	32	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	43	WSHRAT\|B000C75D\|LMMMEQUO\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/7/2023\|JavaScript-v3.4\|NL:Netherlands

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1584	1532	wscript.exe	86
PID 1532 wrote to memory of 1584	1532	wscript.exe	86

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Request For Quotation.js"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Request For Quotation.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js

Filesize
926KB

MD5
d88e96b01cbe12a5dbaefd28ccfcc7dc

SHA1
d1c01512b187176428440463eaae7b7d5be2aabf

SHA256
8cae71910574fa96fdf20ddab8897e90d155e50036ddb2f3d033a7b13a45b90f

SHA512
1dc22521994a390b97ad7e7880f1812b865a22b5c5681bacc3870f37baae37f2772e071f68a6a7b1669664f2c00d0f7c96d8815601bdcef69c43d008da348388

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Request For Quotation.js

Filesize
926KB

MD5
d88e96b01cbe12a5dbaefd28ccfcc7dc

SHA1
d1c01512b187176428440463eaae7b7d5be2aabf

SHA256
8cae71910574fa96fdf20ddab8897e90d155e50036ddb2f3d033a7b13a45b90f

SHA512
1dc22521994a390b97ad7e7880f1812b865a22b5c5681bacc3870f37baae37f2772e071f68a6a7b1669664f2c00d0f7c96d8815601bdcef69c43d008da348388

Download Submit
C:\Users\Admin\AppData\Roaming\Request For Quotation.js

Filesize
926KB

MD5
d88e96b01cbe12a5dbaefd28ccfcc7dc

SHA1
d1c01512b187176428440463eaae7b7d5be2aabf

SHA256
8cae71910574fa96fdf20ddab8897e90d155e50036ddb2f3d033a7b13a45b90f

SHA512
1dc22521994a390b97ad7e7880f1812b865a22b5c5681bacc3870f37baae37f2772e071f68a6a7b1669664f2c00d0f7c96d8815601bdcef69c43d008da348388

Download Submit

Analysis

Sharing