wshrat | 08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f

General

Target

08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js
Size

1019KB
MD5

e8536fd0f118843f3a18ec4e10831f9e
SHA1

873a031c63b540b238aa8ff30d09c08b0f6c3811
SHA256

08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f
SHA512

a50ea7d4dd18b1f0e3614d1544736d445bbea0e44a92a6903ec86c2d06c31d05f3ce5c8cf8d5eb5de87a6ae7710327263cca845f642665cd87f13ca3e74690e5
SSDEEP

6144:MQA7NcHC1yd9hSFIpgRK8VO6CbKZk+rIavG7UjcBfd82TwXtQlTrZ889unEYpcYK:X/

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

C2

http://harold.2waky.com:3609

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 18 IoCs

flow	pid	Process
18	2324	wscript.exe
20	2324	wscript.exe
45	2324	wscript.exe
51	2324	wscript.exe
55	2324	wscript.exe
66	2324	wscript.exe
67	2324	wscript.exe
68	2324	wscript.exe
72	2324	wscript.exe
76	2324	wscript.exe
77	2324	wscript.exe
81	2324	wscript.exe
82	2324	wscript.exe
93	2324	wscript.exe
94	2324	wscript.exe
95	2324	wscript.exe
96	2324	wscript.exe
100	2324	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 17 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	55	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	67	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	72	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	76	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	100	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	20	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	66	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	68	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	81	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	93	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	45	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	77	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	94	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	95	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	96	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	51	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	82	WSHRAT\|E84DA272\|SMIJWJMH\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/9/2023\|JavaScript-v3.4\|NL:Netherlands

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2324	2740	wscript.exe	87
PID 2740 wrote to memory of 2324	2740	wscript.exe	87

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js

Filesize
1019KB

MD5
e8536fd0f118843f3a18ec4e10831f9e

SHA1
873a031c63b540b238aa8ff30d09c08b0f6c3811

SHA256
08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f

SHA512
a50ea7d4dd18b1f0e3614d1544736d445bbea0e44a92a6903ec86c2d06c31d05f3ce5c8cf8d5eb5de87a6ae7710327263cca845f642665cd87f13ca3e74690e5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js

Filesize
1019KB

MD5
e8536fd0f118843f3a18ec4e10831f9e

SHA1
873a031c63b540b238aa8ff30d09c08b0f6c3811

SHA256
08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f

SHA512
a50ea7d4dd18b1f0e3614d1544736d445bbea0e44a92a6903ec86c2d06c31d05f3ce5c8cf8d5eb5de87a6ae7710327263cca845f642665cd87f13ca3e74690e5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f_JC.js

Filesize
1019KB

MD5
e8536fd0f118843f3a18ec4e10831f9e

SHA1
873a031c63b540b238aa8ff30d09c08b0f6c3811

SHA256
08d17101c7bb382a1dc5232be50250baa228e81f56adc40a1a94c574a986c25f

SHA512
a50ea7d4dd18b1f0e3614d1544736d445bbea0e44a92a6903ec86c2d06c31d05f3ce5c8cf8d5eb5de87a6ae7710327263cca845f642665cd87f13ca3e74690e5

Download Submit

Analysis

Sharing