wshrat | 08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
28-09-2023 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tax Returns Of R48,765.js
Size

1019KB
MD5

e8536fd0f118843f3a18ec4e10831f9e
SHA1

873a031c63b540b238aa8ff30d09c08b0f6c3811
SHA256

08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f
SHA512

a50ea7d4dd18b1f0e3614d1544736d445bbea0e44a92a6903ec86c2d06c31d05f3ce5c8cf8d5eb5de87a6ae7710327263cca845f642665cd87f13ca3e74690e5
SSDEEP

6144:MQA7NcHC1yd9hSFIpgRK8VO6CbKZk+rIavG7UjcBfd82TwXtQlTrZ889unEYpcYK:X/

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

http://harold.2waky.com:3609

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 12 IoCs

flow	pid	Process
4	2160	wscript.exe
6	2160	wscript.exe
8	2160	wscript.exe
9	2160	wscript.exe
11	2160	wscript.exe
12	2160	wscript.exe
13	2160	wscript.exe
15	2160	wscript.exe
16	2160	wscript.exe
17	2160	wscript.exe
19	2160	wscript.exe
20	2160	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns Of R48,765.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns Of R48,765.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 11 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	13	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 28/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	15	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 28/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	16	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 28/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	17	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 28/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	20	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 28/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	6	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 28/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	8	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 28/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	9	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 28/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	11	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 28/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	12	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 28/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	19	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 28/9/2023\|JavaScript-v3.4\|NL:Netherlands

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2160	2196	wscript.exe	29
PID 2196 wrote to memory of 2160	2196	wscript.exe	29
PID 2196 wrote to memory of 2160	2196	wscript.exe	29

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Tax Returns Of R48,765.js"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Tax Returns Of R48,765.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tax Returns Of R48,765.js

Filesize
1019KB

MD5
e8536fd0f118843f3a18ec4e10831f9e

SHA1
873a031c63b540b238aa8ff30d09c08b0f6c3811

SHA256
08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f

SHA512
a50ea7d4dd18b1f0e3614d1544736d445bbea0e44a92a6903ec86c2d06c31d05f3ce5c8cf8d5eb5de87a6ae7710327263cca845f642665cd87f13ca3e74690e5

Download Submit
C:\Users\Admin\AppData\Roaming\Tax Returns Of R48,765.js

Filesize
1019KB

MD5
e8536fd0f118843f3a18ec4e10831f9e

SHA1
873a031c63b540b238aa8ff30d09c08b0f6c3811

SHA256
08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f

SHA512
a50ea7d4dd18b1f0e3614d1544736d445bbea0e44a92a6903ec86c2d06c31d05f3ce5c8cf8d5eb5de87a6ae7710327263cca845f642665cd87f13ca3e74690e5

Download Submit