Overview

overview

10

Static

static

1

ORDER_2427589446BF.js

windows7-x64

10

ORDER_2427589446BF.js

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-05-2024 17:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ORDER_2427589446BF.js

  • Size

    7KB

  • MD5

    8a006c1466998c2bde5fa110296bf4da

  • SHA1

    38f5819efe2bfece434ff9de7ce327ad1dab920a

  • SHA256

    fad0c2df718c20c0615e237b5da75f6e93a867d7168921a6af3afb41834b4d05

  • SHA512

    f90be849f383d9919c8463b4041d1e89a4de5e47cf9ef1dcb21f8af0d326857ce45e75c7100aed1c217b885a077001cfa50bb7489144f5f010e84b20c3d19ece

  • SSDEEP

    96:p8KvZU3TRRkyPWXsy7jZRZcmq74qe0tJLgy0c15Q:rsTRAL/ure0tFgc8

Score
10/10
wshratexecutionpersistencetrojan

Malware Config

Extracted

Family

wshrat

C2

http://chongmei33.publicvm.com:7045

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Blocklisted process makes network request 28 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Script User-Agent 25 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ORDER_2427589446BF.js
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HTJAHZ.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:1572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\HTJAHZ.js
    Filesize

    305KB

    MD5

    e46b574e60419cc1211889c5334d9ad1

    SHA1

    7a8dc97591e63ad2c8d95e4ff10db8a154921114

    SHA256

    19d3f805b1b14e5b30cb12595d980479490079e7b8b44e392d3dc89373aa6cd3

    SHA512

    a547c6f5cffcd2fb1cb05617cb642e2125ab7cd1fb11cfed72aa3cb4ce151b1bf73b9ef73905e6d9b1654a5d24e5f9cb76504e388489c8c663fb62b9494b6c39

    Download Submit