wshrat | 4a65fc918ed0e20b294eb7474795f7a47899ecc14cee273322d3c68691a31648

General

Target

abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe
Size

6.5MB
MD5

abaf1bf2dc6afd728dd51a10546d92cc
SHA1

9dd27a0f776631f5811b5320e8b8c10446332b4e
SHA256

4a65fc918ed0e20b294eb7474795f7a47899ecc14cee273322d3c68691a31648
SHA512

f06cafde915e9800ef7db2afcdbcb6842f5bff4c65636815cabd0933f5c9c6c465dc7c9085a3aa4ef18d7bd6dcd6425f3633231b30fa4676f01711c4170eafdc
SSDEEP

196608:9An9naf2sp80b0ArW4+NtkqRoP48s+Kktnv/:29Gza0Tt8kpP41+Kk

Score

10^/10

wshrat execution persistence trojan

Malware Config

Extracted

Family

wshrat

C2

http://freehost222.ddns.net:1555

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015c0f-13.dat	family_wshrat

Blocklisted process makes network request 7 IoCs

flow	pid	Process
5	2608	wscript.exe
7	2608	wscript.exe
8	2608	wscript.exe
9	2608	wscript.exe
10	2608	wscript.exe
11	2608	wscript.exe
12	2608	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
1588	xEnigma32g.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	WSHRAT\|F4850773\|EILATWEW\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 14/6/2024\|JavaScript-v2.0\|GB:United Kingdom
HTTP User-Agent header	8	WSHRAT\|F4850773\|EILATWEW\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 14/6/2024\|JavaScript-v2.0\|GB:United Kingdom
HTTP User-Agent header	9	WSHRAT\|F4850773\|EILATWEW\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 14/6/2024\|JavaScript-v2.0\|GB:United Kingdom
HTTP User-Agent header	10	WSHRAT\|F4850773\|EILATWEW\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 14/6/2024\|JavaScript-v2.0\|GB:United Kingdom
HTTP User-Agent header	11	WSHRAT\|F4850773\|EILATWEW\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 14/6/2024\|JavaScript-v2.0\|GB:United Kingdom
HTTP User-Agent header	12	WSHRAT\|F4850773\|EILATWEW\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 14/6/2024\|JavaScript-v2.0\|GB:United Kingdom

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1588	2436	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	28
PID 2436 wrote to memory of 1588	2436	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	28
PID 2436 wrote to memory of 1588	2436	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	28
PID 2436 wrote to memory of 1588	2436	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	28
PID 2436 wrote to memory of 2052	2436	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	29
PID 2436 wrote to memory of 2052	2436	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	29
PID 2436 wrote to memory of 2052	2436	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2608	2052	WScript.exe	30
PID 2052 wrote to memory of 2608	2052	WScript.exe	30
PID 2052 wrote to memory of 2608	2052	WScript.exe	30

C:\Users\Admin\AppData\Local\Temp\abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
  "C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe"
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xLicense.js"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xLicense.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe

Filesize
6.3MB

MD5
165871e449aff3bcb0e39cf7844ac512

SHA1
07c578daefaa429f2c689d129ad2550e6e498900

SHA256
fb30eadcf2ed6162142941d6282e4ef11134d3a16b711373abb9dada1235b002

SHA512
a126152c2cb0b147eb4f6900e276cd80e8cc661395dbcd298360952d5d7f9154cbea4344579e1b43526bbe3d768a14e2f9467eeb0dc210dee12db930c7af56f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\xLicense.js

Filesize
118KB

MD5
ce9fc3f1e3d6613b95be547853e778d9

SHA1
32dcddfe783545087df170d01c001d1e8cc00de7

SHA256
a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787

SHA512
19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c

Download Submit
memory/1588-14-0x0000000000400000-0x00000000014C9000-memory.dmp

Filesize
16.8MB

Download
memory/1588-23-0x0000000000400000-0x00000000014C9000-memory.dmp

Filesize
16.8MB

Download
memory/2436-0-0x000007FEF5FD3000-0x000007FEF5FD4000-memory.dmp

Filesize
4KB

Download
memory/2436-1-0x00000000008E0000-0x0000000000F62000-memory.dmp

Filesize
6.5MB

Download
memory/2436-2-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download
memory/2436-15-0x000007FEF5FD0000-0x000007FEF69BC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads