Overview

overview

10

Static

static

10

a4dd485c93...c5.vbs

windows7-x64

10

a4dd485c93...c5.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-05-2024 01:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a4dd485c93929dbeb0e6fd056e60aba8211005c76e97c581fc87875b6e3703c5.vbs

  • Size

    162KB

  • MD5

    4c75fc967ca796d4f8da4128b7bebf70

  • SHA1

    8211cb066cda8aa6cfd62d39b6ccd45254d68916

  • SHA256

    a4dd485c93929dbeb0e6fd056e60aba8211005c76e97c581fc87875b6e3703c5

  • SHA512

    5d440d6b5ced3b364c2a1cd7380cdc89d2d5d8220bcb504ab1f2f1b66e0a0c42dfac02a22f3ba041b4a6faf58d5810817759943b49566b0e362d200dd9cb55c1

  • SSDEEP

    3072:tvHpcPqzeEihOHbeM8fTSrnSRFHJnB/nRT/PRoFPAeRoFeO3RMpY:t6PqzeEiheeM8fTSrnSRFHxBvRjRoFPa

Score
10/10
wshratpersistencetrojan

Malware Config

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • WSHRAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4dd485c93929dbeb0e6fd056e60aba8211005c76e97c581fc87875b6e3703c5.vbs"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4472
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\logger.js"
      2⤵
        PID:5028

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\logger.js
      Filesize

      8KB

      MD5

      ae6f781865c0c33163bbd1bb291c9fff

      SHA1

      d1c14e216591588c1b5f0d7f62264c0cd7e235a4

      SHA256

      4b77eac5f82019f3d6bb66fa513a78a65fb0186580e582389f5fcfd337298352

      SHA512

      42a802f0a425b618a8d80924057d666a5a45683b597d26bd3664c6b3535132e0b51461f49a49275fe952ac1f7051086a0b67627e6c0425a0396f11f6dc4c5810

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4dd485c93929dbeb0e6fd056e60aba8211005c76e97c581fc87875b6e3703c5.vbs
      Filesize

      162KB

      MD5

      4c75fc967ca796d4f8da4128b7bebf70

      SHA1

      8211cb066cda8aa6cfd62d39b6ccd45254d68916

      SHA256

      a4dd485c93929dbeb0e6fd056e60aba8211005c76e97c581fc87875b6e3703c5

      SHA512

      5d440d6b5ced3b364c2a1cd7380cdc89d2d5d8220bcb504ab1f2f1b66e0a0c42dfac02a22f3ba041b4a6faf58d5810817759943b49566b0e362d200dd9cb55c1

      Download Submit