wshrat | 301042d2e4c7c38c45d27312dffcd8260060bc8d98ddb510dbbf7f52f1f0f151

General

Target

f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
Size

451KB
MD5

f206fcd4c9308dbd966384dc94ea6811
SHA1

49e1c7affefcbdc4a69ce941704b63f0508760de
SHA256

301042d2e4c7c38c45d27312dffcd8260060bc8d98ddb510dbbf7f52f1f0f151
SHA512

efcce74dc0f7a326a54f7b7a999071236f92d1f0930630f10dbd070e4c3c4d4aef43dcaaa1d570ccb665f39490889529b4a87d73109f83f4477d60c9f2e49789
SSDEEP

6144:vuS/mbZR6tzw+HYzXfjn7FdXjxTpUQPY5e9JfQ3EIY0FY:XmbZRp+4pxxJY5cQ3EIYR

Score

10^/10

wshrat zgrat persistence rat trojan

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/456-6-0x0000000005C50000-0x0000000005C98000-memory.dmp	family_zgrat_v1

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\ugbeh.vbs	family_wshrat

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Blocklisted process makes network request 7 IoCs

Processes:

wscript.exe

flow pid process

35 2980 wscript.exe
36 2980 wscript.exe
57 2980 wscript.exe
64 2980 wscript.exe
66 2980 wscript.exe
75 2980 wscript.exe
79 2980 wscript.exe

flow	pid	process
35	2980	wscript.exe
36	2980	wscript.exe
57	2980	wscript.exe
64	2980	wscript.exe
66	2980	wscript.exe
75	2980	wscript.exe
79	2980	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Control Panel\International\Geo\Nation	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ugbeh.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ugbeh.vbs	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\musaka = "\"C:\\Users\\Admin\\AppData\\Roaming\\musaka.exe\""	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

34 ip-api.com

flow	ioc
34	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

description	pid	process	target process
PID 456 set thread context of 1840	456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

pid process

456 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
456 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 456 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

pid	process
456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exef206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe

description	pid	process	target process
PID 456 wrote to memory of 1840	456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
PID 456 wrote to memory of 1840	456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
PID 456 wrote to memory of 1840	456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
PID 456 wrote to memory of 1840	456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
PID 456 wrote to memory of 1840	456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
PID 456 wrote to memory of 1840	456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
PID 456 wrote to memory of 1840	456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
PID 456 wrote to memory of 1840	456	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
PID 1840 wrote to memory of 2980	1840	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	wscript.exe
PID 1840 wrote to memory of 2980	1840	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	wscript.exe
PID 1840 wrote to memory of 2980	1840	f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe	wscript.exe

C:\Users\Admin\AppData\Local\Temp\f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456

C:\Users\Admin\AppData\Local\Temp\f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\ugbeh.vbs
3⤵
- Blocklisted process makes network request
- Drops startup file
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3484,i,6862816582779850255,3437582573780299282,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:1568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe.log
Filesize
1KB

MD5
7ebe314bf617dc3e48b995a6c352740c

SHA1
538f643b7b30f9231a3035c448607f767527a870

SHA256
48178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8

SHA512
0ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TOZYVZGO\json[1].json
Filesize
297B

MD5
bd0c2d8e6b0fe0de4a3869c02ee43a85

SHA1
21d8cca90ea489f88c2953156e6c3dec6945388b

SHA256
3a3e433f615f99529721ee766ad453b75d73fe213cb1ab74ccbb4c0e32dcd533

SHA512
496b1285f1e78d50dd79b05fa2cbf4a0b655bb3e4515646be3a7c7cdf85d7db6ab35577aa1e294f3d515d707ca341652b5ae9d4b22197e4480226ef8440294b6

Download Submit
C:\Users\Admin\AppData\Roaming\ugbeh.vbs
Filesize
180KB

MD5
8ffe3d7ee738e0573bd189ccc3b539b2

SHA1
94eab63679eca28bcd764d6d5d42094467e3d2ac

SHA256
f4af882c098d1e7c1e989ab36b0653a580d55ac0b52b2f6cd1faa070c738698f

SHA512
5f30d676aca05fcde57f17ddc87ba86a2d05bbf72fe166d97de042eca60dca76413a2bdaebe10e22471ae4689601d849e58cb78eb6aaf4cfa6fd6384dc81b273

Download Submit
memory/456-6-0x0000000005C50000-0x0000000005C98000-memory.dmp

Filesize
288KB

Download
memory/456-4-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/456-5-0x0000000005880000-0x000000000588A000-memory.dmp

Filesize
40KB

Download
memory/456-0-0x0000000000E40000-0x0000000000EB6000-memory.dmp

Filesize
472KB

Download
memory/456-3-0x00000000058D0000-0x0000000005962000-memory.dmp

Filesize
584KB

Download
memory/456-12-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/456-2-0x0000000005E80000-0x0000000006424000-memory.dmp

Filesize
5.6MB

Download
memory/456-1-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/1840-8-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1840-11-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/1840-15-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads