wshrat | 8db1ee6decca485e9542f856906003d946b6244fb0bc44aa1a67528f65264fbe

General

Target

7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js
Size

180KB
MD5

8040208fce8d913e8bfd30d079ff289b
SHA1

ef7a86909f86a1256d4dca3ae06f025eede7af5d
SHA256

7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68
SHA512

9009bac53eeb69271a232a2d5a7b8e941ac1baf3fd46f4aa186e674d0af471725c1ac9898def16e5caa3e37e8bcbe01369dd51e026d617c7f63b6243a7d96cc8
SSDEEP

3072:fp1gHeX3reXff6ZKOBRY+7Q0bamKZtvEzKbURCqeGK/6SbIpklgVDSxGfmuZyas:fp1gHeX3reXff6ZKwRY+cM24RCqeGKZR

Score

10^/10

wshrat evasion execution persistence trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	regedit.exe

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000e000000012266-13.dat	family_wshrat

Wshrat family
wshrat

Blocklisted process makes network request 6 IoCs

flow	pid	Process
5	2320	wscript.exe
7	2320	wscript.exe
8	2320	wscript.exe
9	2320	wscript.exe
11	2320	wscript.exe
12	2320	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs .reg file with regedit 2 IoCs

pid	Process
2524	regedit.exe
2932	regedit.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2524	2552	wscript.exe	31
PID 2552 wrote to memory of 2524	2552	wscript.exe	31
PID 2552 wrote to memory of 2524	2552	wscript.exe	31
PID 2552 wrote to memory of 2320	2552	wscript.exe	32
PID 2552 wrote to memory of 2320	2552	wscript.exe	32
PID 2552 wrote to memory of 2320	2552	wscript.exe	32
PID 2320 wrote to memory of 2932	2320	wscript.exe	33
PID 2320 wrote to memory of 2932	2320	wscript.exe	33
PID 2320 wrote to memory of 2932	2320	wscript.exe	33

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\regedit.exe
  "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Runs .reg file with regedit
  PID:2524
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js" /elevated
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\regedit.exe
    "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Runs .reg file with regedit
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg

Filesize
143B

MD5
0e5411d7ecba9a435afda71c6c39d8fd

SHA1
2d6812052bf7be1b5e213e1d813ae39faa07284c

SHA256
cb68d50df5817e51ec5b2f72893dc4c749bf3504519107e0a78dda84d55f09e2

SHA512
903ac6e5c8a12607af267b54bcbbedfa5542c5b4f7ea289ab7c6a32a424d5b846ae406d830cb4ad48e2b46f92c504163c0856af8c3e09685a8855f39f616ddb1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js

Filesize
180KB

MD5
8040208fce8d913e8bfd30d079ff289b

SHA1
ef7a86909f86a1256d4dca3ae06f025eede7af5d

SHA256
7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68

SHA512
9009bac53eeb69271a232a2d5a7b8e941ac1baf3fd46f4aa186e674d0af471725c1ac9898def16e5caa3e37e8bcbe01369dd51e026d617c7f63b6243a7d96cc8

Download Submit
memory/2524-2-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2524-4-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads