Overview

overview

10

Static

static

1

fad0c2df71...d05.js

windows7-x64

10

fad0c2df71...d05.js

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    29-05-2024 11:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fad0c2df718c20c0615e237b5da75f6e93a867d7168921a6af3afb41834b4d05.js

  • Size

    7KB

  • MD5

    8a006c1466998c2bde5fa110296bf4da

  • SHA1

    38f5819efe2bfece434ff9de7ce327ad1dab920a

  • SHA256

    fad0c2df718c20c0615e237b5da75f6e93a867d7168921a6af3afb41834b4d05

  • SHA512

    f90be849f383d9919c8463b4041d1e89a4de5e47cf9ef1dcb21f8af0d326857ce45e75c7100aed1c217b885a077001cfa50bb7489144f5f010e84b20c3d19ece

  • SSDEEP

    96:p8KvZU3TRRkyPWXsy7jZRZcmq74qe0tJLgy0c15Q:rsTRAL/ure0tFgc8

Score
10/10
wshratexecutionpersistencetrojan

Malware Config

Extracted

Family

wshrat

C2

http://chongmei33.publicvm.com:7045

Signatures

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Blocklisted process makes network request 25 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Script User-Agent 23 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\fad0c2df718c20c0615e237b5da75f6e93a867d7168921a6af3afb41834b4d05.js
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HTJAHZ.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:2740

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\HTJAHZ.js
    Filesize

    305KB

    MD5

    e46b574e60419cc1211889c5334d9ad1

    SHA1

    7a8dc97591e63ad2c8d95e4ff10db8a154921114

    SHA256

    19d3f805b1b14e5b30cb12595d980479490079e7b8b44e392d3dc89373aa6cd3

    SHA512

    a547c6f5cffcd2fb1cb05617cb642e2125ab7cd1fb11cfed72aa3cb4ce151b1bf73b9ef73905e6d9b1654a5d24e5f9cb76504e388489c8c663fb62b9494b6c39

    Download Submit