Overview

overview

10

Static

static

1

Documento.PDF.js

windows7-x64

10

Documento.PDF.js

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2023 04:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Documento.PDF.js

  • Size

    673KB

  • MD5

    6cfadcba2b7a883a4466a8def0e2b446

  • SHA1

    f2680fb39456133b5e034a8642d32c0682ee5f1f

  • SHA256

    85e41bab0ec97c8110d96123d9c0d0c3431dbe4b388f5695baf5221e9d736718

  • SHA512

    d0ca442e9b56a4cad02d51320d63c193c54c7ee1c9aa6146a0ca099d31cebacf70878142cc140244b38b58122f6da577888310ce236cb3db142b2550eeedaa64

  • SSDEEP

    1536:lRxRZ4C5xLSYmOL0hQr8uz3PdkLjNrHBbNHSNL9UL5KT6nsQjkB:h3PdkLjNrhbNHSNLEsYE

Score
10/10
wshratpersistencetrojan

Malware Config

Extracted

Family

wshrat

C2

http://trabajovalle2019.duckdns.org:2040

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Blocklisted process makes network request 21 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 20 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Documento.PDF.js
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Documento.PDF.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:2820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Documento.PDF.js
    Filesize

    92KB

    MD5

    d01fbf4da6cc7eac6ae3c6afd9cda95c

    SHA1

    a520c24da7b67b6f897d32ba56936e3457c59a96

    SHA256

    b6030b7972ac62518a28921e7a69da02e5b39e9d0ff029f7585adc6d97ecb1e8

    SHA512

    0e3dc2cef4306306b66c375b85b21bb3ff8216d5c0f57f20d9872772513bf70c19193d34b220b0e7104dd921afcdcf1635c6e5d6a8185d1140acd48d313a068d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Documento.PDF.js
    Filesize

    92KB

    MD5

    28082f60aeeafd98cde6dab0c0367ce2

    SHA1

    320777b15d16564080c13e52c13c9e81802d477e

    SHA256

    4a76927abd914d9cc186b19e1905ed497058e93f17628d857955f6ece598ee06

    SHA512

    00dc2f945f88e2cb37995852c91861680c98a39e535afbe72510e7b19cfad8717ac8aec4ef3a5ef482d3540a56c9b4fc7822e753568897866e66b3bd1ebb46dc

    Download Submit