wshrat | 530be52b6fab0cbe77614e8321abf7aa90e410a7ebe654c67aece01f6f37ea51

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aeace0a8ab23c3ce61d5350201e0e941_JaffaCakes118.vbs
Size

88KB
MD5

aeace0a8ab23c3ce61d5350201e0e941
SHA1

85c24929f4c1464636e0c6cce6d86973d980a009
SHA256

530be52b6fab0cbe77614e8321abf7aa90e410a7ebe654c67aece01f6f37ea51
SHA512

e44ab057cfbe18fecf41fb1b15d3b0824fe55127083c33d1e23eb77c7484eaaf4937a2c88fdc91de92f6960eb3e8a1152a407dd68213ff99330d40241407f360
SSDEEP

1536:5KQf2k2MLd2AbmVSJUYH4PzKXZBHCRP/9uRHMV7lmbFYcobOH+arEczQp:nn2Ab64laengHVVkfH4CQ

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

http://jeffserver.duckdns.org:3355

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 48 IoCs

flow	pid	Process
3	624	WScript.exe
4	2252	wscript.exe
21	2252	wscript.exe
22	624	WScript.exe
23	2252	wscript.exe
24	624	WScript.exe
25	2252	wscript.exe
26	624	WScript.exe
27	2252	wscript.exe
28	2252	wscript.exe
31	624	WScript.exe
46	2252	wscript.exe
47	624	WScript.exe
48	2252	wscript.exe
49	624	WScript.exe
50	2252	wscript.exe
51	2252	wscript.exe
52	624	WScript.exe
53	2252	wscript.exe
54	624	WScript.exe
57	2252	wscript.exe
58	624	WScript.exe
59	2252	wscript.exe
60	624	WScript.exe
61	2252	wscript.exe
62	2252	wscript.exe
63	624	WScript.exe
64	2252	wscript.exe
65	624	WScript.exe
72	2252	wscript.exe
73	624	WScript.exe
74	2252	wscript.exe
75	2252	wscript.exe
76	624	WScript.exe
77	2252	wscript.exe
78	624	WScript.exe
79	2252	wscript.exe
80	624	WScript.exe
81	2252	wscript.exe
82	624	WScript.exe
83	2252	wscript.exe
84	2252	wscript.exe
85	624	WScript.exe
86	2252	wscript.exe
87	624	WScript.exe
88	2252	wscript.exe
93	624	WScript.exe
95	2252	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aeace0a8ab23c3ce61d5350201e0e941_JaffaCakes118.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aeace0a8ab23c3ce61d5350201e0e941_JaffaCakes118.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\keSoCVJrPF.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\keSoCVJrPF.vbs	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aeace0a8ab23c3ce61d5350201e0e941_JaffaCakes118 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\aeace0a8ab23c3ce61d5350201e0e941_JaffaCakes118.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aeace0a8ab23c3ce61d5350201e0e941_JaffaCakes118 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\aeace0a8ab23c3ce61d5350201e0e941_JaffaCakes118.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keSoCVJrPF = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\keSoCVJrPF.vbs\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keSoCVJrPF = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\keSoCVJrPF.vbs\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2252	624	WScript.exe	82
PID 624 wrote to memory of 2252	624	WScript.exe	82

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aeace0a8ab23c3ce61d5350201e0e941_JaffaCakes118.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\keSoCVJrPF.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aeace0a8ab23c3ce61d5350201e0e941_JaffaCakes118.vbs

Filesize
88KB

MD5
aeace0a8ab23c3ce61d5350201e0e941

SHA1
85c24929f4c1464636e0c6cce6d86973d980a009

SHA256
530be52b6fab0cbe77614e8321abf7aa90e410a7ebe654c67aece01f6f37ea51

SHA512
e44ab057cfbe18fecf41fb1b15d3b0824fe55127083c33d1e23eb77c7484eaaf4937a2c88fdc91de92f6960eb3e8a1152a407dd68213ff99330d40241407f360

Download Submit
C:\Users\Admin\AppData\Roaming\keSoCVJrPF.vbs

Filesize
38KB

MD5
392479347086b65e281338b4fc966a1f

SHA1
3c92a54853777094544adb6b832fb2d904869b0b

SHA256
d9f6ba700117da69da10241c27e799fe982fc20cfe36f76486b7396abfa42772

SHA512
ea1827b4abbf64c5294ce2a237a4d7c145fff5e1eac5a03fed2b80da925a73d99772f027ba8c608d50e945bf60793fa9a6d5e368380475771e118889d0fbae2b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads