wshrat | 577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
29-09-2023 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b262e3cfe7e64378337669bbdf768fb.exe
Size

607KB
MD5

6b262e3cfe7e64378337669bbdf768fb
SHA1

6f2c63adcdda5114299344058464016be1a87c70
SHA256

577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea
SHA512

36e39838c5cd75ff3f14a8d46cfcd9e3ebe12d9c9f35e9fdb6337a3e947d51e383c6800a34a76aab7b9fafd57032110f601c85acf7d19bf381b4e58a13e8363c
SSDEEP

12288:dh1Lk70TnvjcZsqnY9LH8Vaxc07BK9GGjcCUfHP2kuGZiCKAzDN/ELq:Zk70TrcZr3ycKNubUfHDFkCK8h/1

Score

10^/10

wshrat persistence trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012267-24.dat	family_wshrat

Blocklisted process makes network request 39 IoCs

flow	pid	Process
5	2572	wscript.exe
6	2572	wscript.exe
7	2572	wscript.exe
8	2572	wscript.exe
9	2572	wscript.exe
10	2572	wscript.exe
11	2572	wscript.exe
13	2572	wscript.exe
14	2572	wscript.exe
15	2572	wscript.exe
16	2572	wscript.exe
17	2572	wscript.exe
18	2572	wscript.exe
20	2572	wscript.exe
21	2572	wscript.exe
22	2572	wscript.exe
23	2572	wscript.exe
24	2572	wscript.exe
25	2572	wscript.exe
27	2572	wscript.exe
28	2572	wscript.exe
29	2572	wscript.exe
30	2572	wscript.exe
31	2572	wscript.exe
32	2572	wscript.exe
34	2572	wscript.exe
35	2572	wscript.exe
36	2572	wscript.exe
37	2572	wscript.exe
38	2572	wscript.exe
39	2572	wscript.exe
41	2572	wscript.exe
42	2572	wscript.exe
43	2572	wscript.exe
44	2572	wscript.exe
45	2572	wscript.exe
46	2572	wscript.exe
48	2572	wscript.exe
49	2572	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\mGxdd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\mGxdd.vbs\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mGxdd = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\mGxdd.vbs\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 1684	2972	6b262e3cfe7e64378337669bbdf768fb.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	6b262e3cfe7e64378337669bbdf768fb.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1684	2972	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2972 wrote to memory of 1684	2972	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2972 wrote to memory of 1684	2972	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2972 wrote to memory of 1684	2972	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2972 wrote to memory of 1684	2972	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2972 wrote to memory of 1684	2972	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2972 wrote to memory of 1684	2972	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2972 wrote to memory of 1684	2972	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2972 wrote to memory of 1684	2972	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 1684 wrote to memory of 2572	1684	Caspol.exe	29
PID 1684 wrote to memory of 2572	1684	Caspol.exe	29
PID 1684 wrote to memory of 2572	1684	Caspol.exe	29
PID 1684 wrote to memory of 2572	1684	Caspol.exe	29

C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe
"C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\mGxdd.vbs"
    3⤵
    - Blocklisted process makes network request
    - Adds Run key to start application
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\186K4QOS\json[1].json

Filesize
323B

MD5
0c17abb0ed055fecf0c48bb6e46eb4eb

SHA1
a692730c8ec7353c31b94a888f359edb54aaa4c8

SHA256
f41e99f954e33e7b0e39930ec8620bf29801efc44275c1ee6b5cfa5e1be202c0

SHA512
645a9f2f94461d8a187261b736949df398ece5cfbf1af8653d18d3487ec1269d9f565534c1e249c12f31b3b1a41a8512953b1e991b001fc1360059e3fd494ec3

Download Submit
C:\Users\Admin\AppData\Roaming\mGxdd.vbs

Filesize
180KB

MD5
37a528b11508543c88de17f1dc8eadc4

SHA1
5be2f519aefb6ee299a3b9d845e4aa22101bf572

SHA256
7a31ecc65101516fcb5db437a545a1082b41126021dd341791f5a89d8951762e

SHA512
b11e195a91c47ae8fd082668eab1ba9f02d0eaf4a763579e9cc394e4977108865cf61e8921066499c7d2a32cdbc08d0de6eb4ccf90881fcf698b5c2f6ff11bdd

Download Submit
memory/1684-18-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1684-23-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/1684-21-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/1684-20-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1684-6-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1684-8-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1684-10-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1684-12-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1684-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1684-15-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2972-4-0x0000000004A10000-0x0000000004C4C000-memory.dmp

Filesize
2.2MB

Download
memory/2972-17-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/2972-5-0x00000000022F0000-0x0000000002302000-memory.dmp

Filesize
72KB

Download
memory/2972-1-0x0000000004C50000-0x0000000004E8E000-memory.dmp

Filesize
2.2MB

Download
memory/2972-3-0x00000000049D0000-0x0000000004A10000-memory.dmp

Filesize
256KB

Download
memory/2972-2-0x00000000049D0000-0x0000000004A10000-memory.dmp

Filesize
256KB

Download
memory/2972-0-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads