wshrat | a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c

General

Target

a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c_JC.js
Size

941KB
MD5

aefbde8b2feb2370f55b45f7c9fb33f8
SHA1

5bcee2dc04e6bef1c9753ef1b8d86e55a46a94de
SHA256

a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c
SHA512

8657a53c5efc479c26e29fab3c058784420224e5c511a1b70bb9ad187a5d3719a7abf265b6e1ad64ffd17cb295c29a674086276594534efeb69d8858fcc4733d
SSDEEP

6144:MQPp6tU2vR4K1zzGxx29tUHwYwdetKadJjXqs4TSBdWHYa7iiRhqb0YDFL0jEhHb:Xj9

Score

10^/10

wshrat trojan

Malware Config

Extracted

Family

wshrat

C2

http://harold.2waky.com:1604

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 27 IoCs

flow	pid	Process
19	3436	wscript.exe
22	3436	wscript.exe
39	3436	wscript.exe
46	3436	wscript.exe
47	3436	wscript.exe
48	3436	wscript.exe
61	3436	wscript.exe
63	3436	wscript.exe
64	3436	wscript.exe
65	3436	wscript.exe
66	3436	wscript.exe
68	3436	wscript.exe
71	3436	wscript.exe
76	3436	wscript.exe
77	3436	wscript.exe
78	3436	wscript.exe
82	3436	wscript.exe
83	3436	wscript.exe
88	3436	wscript.exe
95	3436	wscript.exe
96	3436	wscript.exe
97	3436	wscript.exe
98	3436	wscript.exe
99	3436	wscript.exe
100	3436	wscript.exe
104	3436	wscript.exe
106	3436	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c_JC.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c_JC.js	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 26 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	99	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	66	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	76	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	78	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	95	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	88	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	100	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	106	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	68	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	77	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	82	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	83	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	97	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	22	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	46	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	48	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	63	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	65	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	71	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	96	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	98	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	39	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	47	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	61	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	64	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	104	WSHRAT\|084DE619\|SXUYPNET\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/10/2023\|JavaScript-v3.4\|NL:Netherlands

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3436	1224	wscript.exe	86
PID 1224 wrote to memory of 3436	1224	wscript.exe	86

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c_JC.js
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c_JC.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c_JC.js

Filesize
64KB

MD5
000061a64c3b9ebfb992e693ab71bab9

SHA1
c7a83768f96a495e6c5279474120e9aba7c517e6

SHA256
0999252a950e4682ff017dddd2143ac614bd77cfd96a6567bc29b62c0ca47148

SHA512
6e4698766a60685cc419cafb5e64565ff737548822e78f625b85a568cb797772bb34d0d989dbb611ea75b80e153ca0547e29cb096ba3ae85c6f24c640325f9bb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c_JC.js

Filesize
941KB

MD5
aefbde8b2feb2370f55b45f7c9fb33f8

SHA1
5bcee2dc04e6bef1c9753ef1b8d86e55a46a94de

SHA256
a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c

SHA512
8657a53c5efc479c26e29fab3c058784420224e5c511a1b70bb9ad187a5d3719a7abf265b6e1ad64ffd17cb295c29a674086276594534efeb69d8858fcc4733d

Download Submit
C:\Users\Admin\a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c_JC.js

Filesize
941KB

MD5
aefbde8b2feb2370f55b45f7c9fb33f8

SHA1
5bcee2dc04e6bef1c9753ef1b8d86e55a46a94de

SHA256
a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c

SHA512
8657a53c5efc479c26e29fab3c058784420224e5c511a1b70bb9ad187a5d3719a7abf265b6e1ad64ffd17cb295c29a674086276594534efeb69d8858fcc4733d

Download Submit

Analysis

Sharing