Overview

overview

10

Static

static

1

Documento.PDF.js

windows7-x64

10

Documento.PDF.js

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-12-2023 04:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Documento.PDF.js

  • Size

    673KB

  • MD5

    6cfadcba2b7a883a4466a8def0e2b446

  • SHA1

    f2680fb39456133b5e034a8642d32c0682ee5f1f

  • SHA256

    85e41bab0ec97c8110d96123d9c0d0c3431dbe4b388f5695baf5221e9d736718

  • SHA512

    d0ca442e9b56a4cad02d51320d63c193c54c7ee1c9aa6146a0ca099d31cebacf70878142cc140244b38b58122f6da577888310ce236cb3db142b2550eeedaa64

  • SSDEEP

    1536:lRxRZ4C5xLSYmOL0hQr8uz3PdkLjNrHBbNHSNL9UL5KT6nsQjkB:h3PdkLjNrhbNHSNLEsYE

Score
10/10
wshratpersistencetrojan

Malware Config

Extracted

Family

wshrat

C2

http://trabajovalle2019.duckdns.org:2040

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Blocklisted process makes network request 23 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 16 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Documento.PDF.js
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1340
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Documento.PDF.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:2324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Documento.PDF.js
    Filesize

    381KB

    MD5

    4d1f2271ea60c39942babd9a2af65f1e

    SHA1

    e1935bc6cf6a43dac6365436de58eaa45b28464e

    SHA256

    fb10f0fd675254b2ae49597ba58e9f87efdfde318eb7110262edcddea4c12295

    SHA512

    ee10ec3dc09a1bd23588cc5aceee5cfeab4f66f5f8678df6d5fbc1c6657b2ca4a832f191dd2bea1cc2d397e89b93659ca0a4a9881457fc9cb3e388afd73f41c3

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Documento.PDF.js
    Filesize

    673KB

    MD5

    6cfadcba2b7a883a4466a8def0e2b446

    SHA1

    f2680fb39456133b5e034a8642d32c0682ee5f1f

    SHA256

    85e41bab0ec97c8110d96123d9c0d0c3431dbe4b388f5695baf5221e9d736718

    SHA512

    d0ca442e9b56a4cad02d51320d63c193c54c7ee1c9aa6146a0ca099d31cebacf70878142cc140244b38b58122f6da577888310ce236cb3db142b2550eeedaa64

    Download Submit