wshrat | 3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00

Resubmissions

15/09/2026, 11:29

260915-nlkgaatzg1

07/08/2026, 14:21

07/08/2026, 14:20

06/08/2026, 22:19

06/08/2026, 22:01

06/08/2026, 03:44

10/07/2026, 00:11

Analysis

max time kernel
598s
max time network
604s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js
Size 193KB
Sample260806-ear8baff46
SHA256 3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00
MD5 421bdc206ca515eff10d9019e7d6682d
SHA1 61d69fe41176f9dcf84fcc451cd3375d55b277c6
SHA512 d1ad2b34cb8f816468839ed38fce1ea9ca7bae14a30807832d2c108608ecfc2b1f9cec1e5254b6bbae0827b3f2944b504b750d3f6a3499bcdf2847d2aabb9507
SSDEEP 6144:GpdWeXigeXFd1LdkiOBvRZRHFPAeRnAklgF2GuuZD:4Sd1LjOJ7dTtl029q
TLSH
T16F14A07B690AFDDDA7762AC090292615CCDDB60B1308C158FACCB5483F76160CFBA976
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution wshrat persistence privilege_escalation trojan

Malware Config

Signatures

Family: WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 1 IoCs

resource	yara_rule
behavioral18/files/0x0007000000024499-8.dat	family_wshrat

Badlisted process makes network request 32 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	988	wscript.exe
10	988	wscript.exe
11	988	wscript.exe
17	988	wscript.exe
19	988	wscript.exe
33	988	wscript.exe
36	988	wscript.exe
37	988	wscript.exe
38	988	wscript.exe
39	988	wscript.exe
45	4072	wscript.exe
46	4072	wscript.exe
53	4072	wscript.exe
62	4072	wscript.exe
66	4072	wscript.exe
68	4072	wscript.exe
72	4072	wscript.exe
73	4072	wscript.exe
75	4072	wscript.exe
76	4072	wscript.exe
77	4072	wscript.exe
80	4072	wscript.exe
82	4072	wscript.exe
84	4072	wscript.exe
85	4072	wscript.exe
86	4072	wscript.exe
88	4072	wscript.exe
89	4072	wscript.exe
92	4072	wscript.exe
93	4072	wscript.exe
95	4072	wscript.exe
96	4072	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js\""	wscript.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
39	pastebin.com
5	pastebin.com
17	pastebin.com
37	pastebin.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
44	ip-api.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 4072	988	wscript.exe	96

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js"
  2⤵
  - Badlisted process makes network request
  - Creates a file in the Startup directory
  - Adds Run key to start application
  PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uLekaxYr[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1G6LDOHX\uLekaxYr[1].htm
Size 173B
SHA256 5bd1cb20b56bb3ea06d9c3f0abe9223a38e93f3d833df496524dcdebfeb3b4ca
MD5 bcd560eba80b849c980a5123047bc8f8
SHA1 cfc17fc5f3743042a8e00ea8d8b2a1e17a739f89
SHA512 1fcc48ff7443592fd8bc612d9625171563bc1c6a31d825fbf1fa888e4102b1ff0616a425f5d59bb7784a671d86bbf0cb637a98be95de8c94a98dfa9a13349a2b
TLSH
T176C0806D6B533C9874973B3950C39160E1DC503023D9041112704507F0CB1D78DC23D1
MD5 SHA1 SHA512 TLSH

Submit Download

uLekaxYr[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MZB3MSV9\uLekaxYr[1].txt
Size 13B
SHA256 2dfa9df9dacae3dc4f6ac7b8b3c443bd66f29e684f7649fad0046b2af6547fde
MD5 8530569e77a351c51f03d495dcef94f3
SHA1 b4be8ed005959df52a946e2f20ee428cb6d033af
SHA512 363b87a3720e5bffcc64b079a135b1c8b2768a9cd17b42b55ffe149b31521209999aa9183a7539a51f134706102dc5433702c9df2bd1259a001464324bc0c567
MD5 SHA1 SHA512

Submit Download

3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js

Path C:\Users\Admin\AppData\Roaming\3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00.js
Size 193KB
SHA256 3c19d6224812487da6d3d181f7c61cbfd3d329005f34f176c2138a7e5f20cb00
MD5 421bdc206ca515eff10d9019e7d6682d
SHA1 61d69fe41176f9dcf84fcc451cd3375d55b277c6
SHA512 d1ad2b34cb8f816468839ed38fce1ea9ca7bae14a30807832d2c108608ecfc2b1f9cec1e5254b6bbae0827b3f2944b504b750d3f6a3499bcdf2847d2aabb9507
SSDEEP 6144:GpdWeXigeXFd1LdkiOBvRZRHFPAeRnAklgF2GuuZD:4Sd1LjOJ7dTtl029q
TLSH
T16F14A07B690AFDDDA7762AC090292615CCDDB60B1308C158FACCB5483F76160CFBA976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads