wshrat | 0d233c96aa7f53cec4c2f23cec481e7bbfa19995b67c997f7edb94afe8cca8d9

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2024 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6094df12286a36fb1428afc89e3c19c5.js
Size

123KB
MD5

6094df12286a36fb1428afc89e3c19c5
SHA1

e6f25d74194e1482fd597def62f0ae3ba48f9760
SHA256

0d233c96aa7f53cec4c2f23cec481e7bbfa19995b67c997f7edb94afe8cca8d9
SHA512

04a75076a5318730bb998e52de1403d41674f04d9c37cb28f096ff0c60da302f65a58ebbe224d74b3d22eed1d80b82c074bf06061fe31c0566f24ebffde28a0e
SSDEEP

1536:q9mx0dB/va/w/XJgZLyjw7aj+ovdff991AuPR+YAhFgG99W+2QSEooATaRa:onB/nRgZzcVfn/PROFPAeRa

Score

10^/10

wshrat persistence trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023131-5.dat	family_wshrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	3556	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6094df12286a36fb1428afc89e3c19c5.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6094df12286a36fb1428afc89e3c19c5.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6094df12286a36fb1428afc89e3c19c5 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\6094df12286a36fb1428afc89e3c19c5.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6094df12286a36fb1428afc89e3c19c5 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\6094df12286a36fb1428afc89e3c19c5.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\6094df12286a36fb1428afc89e3c19c5.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6094df12286a36fb1428afc89e3c19c5.js

Filesize
123KB

MD5
6094df12286a36fb1428afc89e3c19c5

SHA1
e6f25d74194e1482fd597def62f0ae3ba48f9760

SHA256
0d233c96aa7f53cec4c2f23cec481e7bbfa19995b67c997f7edb94afe8cca8d9

SHA512
04a75076a5318730bb998e52de1403d41674f04d9c37cb28f096ff0c60da302f65a58ebbe224d74b3d22eed1d80b82c074bf06061fe31c0566f24ebffde28a0e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads