wshrat | 427b7d14d7b35fce4320a1fdaa5afb6df6698b536322a937b0d838e0281db20b

General

Target

427b7d14d7b35fce4320a1fdaa5afb6df6698b536322a937b0d838e0281db20b.js
Size

8KB
MD5

2a60755d218ae24e20471575bfd88b60
SHA1

3096b50ad0794588b64c5e38880f5d1bf17fe699
SHA256

427b7d14d7b35fce4320a1fdaa5afb6df6698b536322a937b0d838e0281db20b
SHA512

a72dba3c3110dfdbec8556cf40043c63b36578765de51af9e446f75346d36f65643e66ddc0d3728a1b6b83ba4dbbe118e2f0bef0c9a28644f66b75c420c66506
SSDEEP

192:GcEBLu9pDcEBocEBgBcKbWJMeMjrGPFYiaWcEBalN6u9pDcEBwX5J+PT6cEBhAPx:G4

Score

10^/10

wshrat execution persistence trojan

Malware Config

Extracted

Family

wshrat

C2

http://chongmei33.publicvm.com:7045

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 27 IoCs

flow	pid	Process
2	2628	wscript.exe
4	2628	wscript.exe
12	1852	WScript.exe
15	1852	WScript.exe
16	1852	WScript.exe
17	1852	WScript.exe
18	1852	WScript.exe
27	1852	WScript.exe
33	1852	WScript.exe
34	1852	WScript.exe
35	1852	WScript.exe
36	1852	WScript.exe
39	1852	WScript.exe
42	1852	WScript.exe
43	1852	WScript.exe
44	1852	WScript.exe
45	1852	WScript.exe
46	1852	WScript.exe
53	1852	WScript.exe
54	1852	WScript.exe
55	1852	WScript.exe
56	1852	WScript.exe
57	1852	WScript.exe
58	1852	WScript.exe
59	1852	WScript.exe
60	1852	WScript.exe
61	1852	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MBBOBL.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MBBOBL.js	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MBBOBL = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\MBBOBL.js\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MBBOBL = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\MBBOBL.js\""	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	wscript.exe

Script User-Agent 25 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	16	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	17	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	35	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	39	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	43	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	56	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	42	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	15	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	27	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	46	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	55	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	57	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	58	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	33	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	34	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	36	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	45	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	53	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	60	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	44	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	59	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	12	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	18	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	54	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript
HTTP User-Agent header	61	WSHRAT\|5C2C50AC\|OBJIYUIE\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 9/5/2024\|JavaScript

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1852	2628	wscript.exe	83
PID 2628 wrote to memory of 1852	2628	wscript.exe	83

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\427b7d14d7b35fce4320a1fdaa5afb6df6698b536322a937b0d838e0281db20b.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MBBOBL.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MBBOBL.js

Filesize
305KB

MD5
bf62803354132660998a1fe56437bbfe

SHA1
231bf1f1a52017d7b3f11400d419c8e4f0691452

SHA256
8856b9dd4111bf5af89d69af8ba9efc26cf4e81f7367b876377fb85f872d18e7

SHA512
63de4666e8cfd812afaa9c3067cf53a310f284fe32a351ccafa6e7284c7c0e5e5d147adc56c65809941dd26124082cf034784550723a17f0fceaeaf387fbcacd

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads