wshrat | 8db1ee6decca485e9542f856906003d946b6244fb0bc44aa1a67528f65264fbe

General

Target

7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js
Size

180KB
MD5

8040208fce8d913e8bfd30d079ff289b
SHA1

ef7a86909f86a1256d4dca3ae06f025eede7af5d
SHA256

7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68
SHA512

9009bac53eeb69271a232a2d5a7b8e941ac1baf3fd46f4aa186e674d0af471725c1ac9898def16e5caa3e37e8bcbe01369dd51e026d617c7f63b6243a7d96cc8
SSDEEP

3072:fp1gHeX3reXff6ZKOBRY+7Q0bamKZtvEzKbURCqeGK/6SbIpklgVDSxGfmuZyas:fp1gHeX3reXff6ZKwRY+cM24RCqeGKZR

Score

10^/10

wshrat evasion execution persistence trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	regedit.exe

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000227be-11.dat	family_wshrat

Wshrat family
wshrat

Blocklisted process makes network request 6 IoCs

flow	pid	Process
36	4824	wscript.exe
38	4824	wscript.exe
65	4824	wscript.exe
74	4824	wscript.exe
78	4824	wscript.exe
79	4824	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	ip-api.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	wscript.exe

Runs .reg file with regedit 2 IoCs

pid	Process
1828	regedit.exe
4040	regedit.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1828	1096	wscript.exe	86
PID 1096 wrote to memory of 1828	1096	wscript.exe	86
PID 1096 wrote to memory of 4824	1096	wscript.exe	97
PID 1096 wrote to memory of 4824	1096	wscript.exe	97
PID 4824 wrote to memory of 4040	4824	wscript.exe	98
PID 4824 wrote to memory of 4040	4824	wscript.exe	98

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\regedit.exe
  "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Runs .reg file with regedit
  PID:1828
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js" /elevated
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\regedit.exe
    "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Runs .reg file with regedit
    PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ebgeaegdbdecaedfebace.reg

Filesize
143B

MD5
0e5411d7ecba9a435afda71c6c39d8fd

SHA1
2d6812052bf7be1b5e213e1d813ae39faa07284c

SHA256
cb68d50df5817e51ec5b2f72893dc4c749bf3504519107e0a78dda84d55f09e2

SHA512
903ac6e5c8a12607af267b54bcbbedfa5542c5b4f7ea289ab7c6a32a424d5b846ae406d830cb4ad48e2b46f92c504163c0856af8c3e09685a8855f39f616ddb1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68.js

Filesize
180KB

MD5
8040208fce8d913e8bfd30d079ff289b

SHA1
ef7a86909f86a1256d4dca3ae06f025eede7af5d

SHA256
7fbe90daab199a8095505ce3b7e9e13a23b638e84378bf5809e84fc91ee92a68

SHA512
9009bac53eeb69271a232a2d5a7b8e941ac1baf3fd46f4aa186e674d0af471725c1ac9898def16e5caa3e37e8bcbe01369dd51e026d617c7f63b6243a7d96cc8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads