SOC Incident Investigation — 2026

WSHRAT Malware
VBScript Incident Response

Full incident response investigation of a WSHRAT malware infection delivered through a spear-phishing email impersonating GoDaddy. The malicious VBS file used a double-extension masquerading technique (Purchase_Order.xls.vbs) to trick the user. Analysis includes Registry Run key persistence, C2 beaconing to remote infrastructure, and full containment.

MITRE ATT&CK NIST SP 800-61 Sysinternals
View Analysis Download Report LetsDefend Profile Back to SOC & IR
Overview

Incident at a Glance

0[1] Attack Chain Stages
0[2] C2 Protocols
0[3] Detection Rules
0[4] Compromised Assets
Analysis

Incident Investigation

Step-by-step investigation following NIST SP 800-61 IR methodology, from phishing analysis through containment and remediation.

Phishing Attack

Initial compromise via spear-phishing email from support@gododdy.com impersonating GoDaddy. Email contained Purchase_Order.zip with a VBS file using double extension (Purchase_Order.xls.vbs) to masquerade as an Excel spreadsheet. User downloaded and executed the file through Chrome from a malicious S3 bucket.

Persistence & C2

WSHRAT established persistence through two mechanisms: Registry Run key (HKU\...\CurrentVersion\Run\Purchase_Order.xls.vbs) and Windows Startup folder. C2 beaconing detected to chongmei33.publicvm.com (103.47.144.80) on port 7045. Outbound connections flagged as malicious on VirusTotal.

Containment & Remediation

Host isolated from network via endpoint security platform. Phishing email deleted from user mailbox. Malicious VBS file removed from file system. User educated on identifying double-extension files and reporting suspicious emails to the security team.

Timeline

Attack Timeline

Reconstructed from email security logs, Sysmon events, and endpoint telemetry.

09:40
Phishing email received — Purchase_Order.zip downloaded from S3 bucket
09:40
Purchase_Order.xls.vbs executed via WScript.exe from Downloads folder
09:40
WSHRAT adds Registry Run key persistence + Startup folder entry
09:40+
C2 beaconing to chongmei33.publicvm.com:7045 (103.47.144.80)
—
Host isolated — malicious files removed — phishing email deleted
Framework

MITRE ATT&CK Mapping

Attack techniques mapped to the MITRE ATT&CK framework.

Initial Access

T1566 — Phishing

Execution

T1059 — Command and Scripting Interpreter

Persistence

T1547 — Boot or Logon Autostart Execution

Defense Evasion

T1036 — Masquerading

Report

Full Incident Report

Complete writeup covering detection, analysis, containment, remediation, and lessons learned.

Download Report (PDF) Back to SOC & IR

References

  1. Attack Chain Analysis — 5-stage WSHRAT attack chain (delivery, execution, persistence, C2, data theft) mapped to MITRE ATT&CK.
  2. C2 Protocol Analysis — 2 C2 protocols (HTTP and DNS tunneling) used for command and control with detection bypass techniques.
  3. Detection Rules — 30 Sigma detection rules covering WSHRAT-specific IOCs, behavioral patterns, and network indicators.
  4. Incident Report — Full incident response report with timeline, artifacts, containment procedures, and lessons learned.

Full deliverables available in the project repository.