wshrat | 795a5fad26bf022360bdb88d73d356037f0f644fd23c899f88547fa9552c6759

General

Target

38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf.vbs
Size

254KB
MD5

bfb4e820b764be9c6ca3a7be5afdc124
SHA1

21e8d148050fa80830ee64cbf99d67292a21fabc
SHA256

38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf
SHA512

506a151144d5323156066d1a746bd3d9e14b99a170d1e89d9424a5a98dd05a794ab0aa32766b073f58ad866716ef25972b3a44a9d56fad80003c0abf13ced27f
SSDEEP

6144:ywKmqM4d6gb5mjTS8EoL36Uc2TEspbmWVX7FilDCtzQbxkGsg5:QdeTSWdI8mWVM+OGHs

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

C2

http://poseidon99.duckdns.org:4758

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 13 IoCs

flow	pid	Process
54	1656	WScript.exe
63	1656	WScript.exe
65	1656	WScript.exe
69	1656	WScript.exe
73	1656	WScript.exe
80	1656	WScript.exe
87	1656	WScript.exe
88	1656	WScript.exe
90	1656	WScript.exe
91	1656	WScript.exe
92	1656	WScript.exe
102	1656	WScript.exe
105	1656	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf.vbs\""	WScript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1452	taskmgr.exe
1452	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1452	taskmgr.exe
Token: SeSystemProfilePrivilege	1452	taskmgr.exe
Token: SeCreateGlobalPrivilege	1452	taskmgr.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1400	1656	WScript.exe	96
PID 1656 wrote to memory of 1400	1656	WScript.exe	96

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38bd5894a8e1c294b4ea9f3809a1bb7d987af8db390063603c2fca96df2a77bf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\skbgbpTewK.vbs"
  2⤵
  PID:1400

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:5040

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:2260

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L3T8W3B4\json[1].json

Filesize
313B

MD5
bee55e52500f967c3d9402e05dd57f65

SHA1
d8dc65ec97c6288e1fd10b8c4f8502e5a8a5bbf6

SHA256
b90eae4b05d321efc4519963349c1775dcea8e3b0ae53b50285545380b6539c0

SHA512
b8624a934fb74760f5b231ca97e89074b227ad9fe3bb08b01a81cf35760f06b346f395cf6683df5881dc429ae77af0d0a07cfeb9c9ec127e4e917191bf8c91da

Download Submit
C:\Users\Admin\AppData\Roaming\skbgbpTewK.vbs

Filesize
6KB

MD5
66121bf8c5e18b7814b69a483f7b126f

SHA1
382910b59dd360c5e394a27717f7fcee6c10ef59

SHA256
41677f6a37375aa6a7abb978d9c017132aec64e8fb989096ccaf40a314e1e019

SHA512
7a46ef5590caf7970451d49028d3294034c90c297feeff2ea99d5311cdaf81bc92de080469fcb8fdd3c08001f9dbd222260b8764bf68d1013cf1e35b10253255

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads