Overview

overview

10

Static

static

1

ORDER-2461...-24.js

windows7-x64

10

ORDER-2461...-24.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDER-24617-01667859-24.001

  • Size

    714B

  • Sample

    240617-m96trasbkk

  • MD5

    19a81145c349fca5fe2e220f38efa4f9

  • SHA1

    1af10706ea05b364b9ebfff5269dfdb57aee43b5

  • SHA256

    3c881e2fb1512cbee7733901141d98c1ba75f107a9438f5ad46b86a3878bfb81

  • SHA512

    905ecc05d7779f31eda8ad9ac3bba5ab04e69001976cab1d96b3b4d29cb75f73f34b7c382c2e14ebd93348f020066d12305d396892483c62adcc94bced322e41

Score
10/10
wshratexecutionpersistencetrojan

Malware Config

Extracted

Family

wshrat

C2

http://jinvestments.duckdns.org:7044

Targets

    • Target

      ORDER-24617-01667859-24.js

    • Size

      7KB

    • MD5

      f3e6a7eba2bd6ca312768ac1560bad6f

    • SHA1

      04a683416a38f3c8acf06b64fd5e598a2902f684

    • SHA256

      7a06aaf3103d9dce60c0c4652fd505c7a8df42c826d486be1973008d1c22c838

    • SHA512

      4ea84c8c33a0fa6a235f6b5ec620e172a5ea5f4a9f372307ea9e1946d6393326bec448e32cadacb1c444270c973046a09be3c590fb7ae61fcc76999553e03265

    • SSDEEP

      48:95jUotZH9ZR0/kdlZK8rflZPos9ZPfBjBZfo5CvA7ehZvKoN69ZLi1t16r1SBZ5B:T0/ZYbukAKdrKBXB1XBdi

    Score
    10/10
    wshratexecutionpersistencetrojan

    • WSHRAT

      WSHRAT is a variant of Houdini worm and has vbs and js variants.

      trojanwshrat

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks