wshrat | 4a65fc918ed0e20b294eb7474795f7a47899ecc14cee273322d3c68691a31648

General

Target

abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe
Size

6.5MB
MD5

abaf1bf2dc6afd728dd51a10546d92cc
SHA1

9dd27a0f776631f5811b5320e8b8c10446332b4e
SHA256

4a65fc918ed0e20b294eb7474795f7a47899ecc14cee273322d3c68691a31648
SHA512

f06cafde915e9800ef7db2afcdbcb6842f5bff4c65636815cabd0933f5c9c6c465dc7c9085a3aa4ef18d7bd6dcd6425f3633231b30fa4676f01711c4170eafdc
SSDEEP

196608:9An9naf2sp80b0ArW4+NtkqRoP48s+Kktnv/:29Gza0Tt8kpP41+Kk

Score

10^/10

wshrat execution persistence trojan

Malware Config

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00080000000235e7-20.dat	family_wshrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xLicense.js	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4108	xEnigma32g.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xLicense = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\xLicense.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 4108	3508	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	92
PID 3508 wrote to memory of 4108	3508	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	92
PID 3508 wrote to memory of 4108	3508	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	92
PID 3508 wrote to memory of 3056	3508	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	93
PID 3508 wrote to memory of 3056	3508	abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe	93
PID 3056 wrote to memory of 3668	3056	WScript.exe	94
PID 3056 wrote to memory of 3668	3056	WScript.exe	94

C:\Users\Admin\AppData\Local\Temp\abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\abaf1bf2dc6afd728dd51a10546d92cc_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe
  "C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe"
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xLicense.js"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xLicense.js"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4324,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=1328 /prefetch:8
1⤵
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xEnigma32g.exe

Filesize
6.3MB

MD5
165871e449aff3bcb0e39cf7844ac512

SHA1
07c578daefaa429f2c689d129ad2550e6e498900

SHA256
fb30eadcf2ed6162142941d6282e4ef11134d3a16b711373abb9dada1235b002

SHA512
a126152c2cb0b147eb4f6900e276cd80e8cc661395dbcd298360952d5d7f9154cbea4344579e1b43526bbe3d768a14e2f9467eeb0dc210dee12db930c7af56f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\xLicense.js

Filesize
118KB

MD5
ce9fc3f1e3d6613b95be547853e778d9

SHA1
32dcddfe783545087df170d01c001d1e8cc00de7

SHA256
a239dab614ef4ad6c7da27fd67564614f0bb273aa4fb10a3033e4e6ad2572787

SHA512
19d68d65417eed27c6ac813df1751e8ccdb6e525ed0004965581d4290a5b953082809ea2b650014a3ccebbba8d620fbaa4e91cdd170ebf1d2487534238a2498c

Download Submit
memory/3508-0-0x00007FF842863000-0x00007FF842865000-memory.dmp

Filesize
8KB

Download
memory/3508-1-0x0000000000E60000-0x00000000014E2000-memory.dmp

Filesize
6.5MB

Download
memory/3508-2-0x00007FF842860000-0x00007FF843321000-memory.dmp

Filesize
10.8MB

Download
memory/3508-19-0x00007FF842860000-0x00007FF843321000-memory.dmp

Filesize
10.8MB

Download
memory/4108-18-0x0000000000400000-0x00000000014C9000-memory.dmp

Filesize
16.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads