vjw0rm | 99d7b67e0d011b22fe3e491445fe0a6dab5e6999d8f7fb99ec505d434255d712

General

Target
4.js
Size 9KB
Sample210707-fbwpj4azta
SHA256 99d7b67e0d011b22fe3e491445fe0a6dab5e6999d8f7fb99ec505d434255d712
MD5 b5e34472d72474569a2332ce317f4cc1
SHA1 209017707d1e40faa9ec527e2128ef25de4b76ce
SHA512 2d18a8be9a19fa77336d950c18257039f4fe5165c354aae253efba0509c72a879a6ccbf3ec2275345deeed39d31227ae95ff7c56fa1583919e715ad6f5ba0094
MD5 SHA1 SHA512

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 5 IoCs

flow	pid	Process
7	3176	wscript.exe
13	2088	WScript.exe
18	1700	wscript.exe
20	1700	wscript.exe
21	1700	wscript.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A84AXBNN6A.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EA347B7QRQ.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EA347B7QRQ.js	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A84AXBNN6A.js	WScript.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A84AXBNN6A = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\A84AXBNN6A.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A84AXBNN6A = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\A84AXBNN6A.js\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\A84AXBNN6A = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\A84AXBNN6A.js\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\A84AXBNN6A = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\A84AXBNN6A.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\I0ZIRGD8RJ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\GF5EHB4I0U = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EA347B7QRQ.js\""	WScript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1676	schtasks.exe
4088	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	wscript.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	20	WSHRAT\|A2C56C1C\|RJMQBVDN\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 7/7/2021\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	21	WSHRAT\|A2C56C1C\|RJMQBVDN\|Admin\|Microsoft Windows 10 Enterprise\|plus\|nan-av\|false - 7/7/2021\|JavaScript-v3.4\|NL:Netherlands

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 1676	3176	wscript.exe	74
PID 3176 wrote to memory of 1676	3176	wscript.exe	74
PID 3176 wrote to memory of 2088	3176	wscript.exe	79
PID 3176 wrote to memory of 2088	3176	wscript.exe	79
PID 2088 wrote to memory of 4088	2088	WScript.exe	80
PID 2088 wrote to memory of 4088	2088	WScript.exe	80
PID 3176 wrote to memory of 3848	3176	wscript.exe	83
PID 3176 wrote to memory of 3848	3176	wscript.exe	83
PID 3848 wrote to memory of 1700	3848	WScript.exe	84
PID 3848 wrote to memory of 1700	3848	WScript.exe	84

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\4.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\4.js
  2⤵
  - Creates scheduled task(s)
  PID:1676
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\EA347B7QRQ.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\EA347B7QRQ.js
    3⤵
    - Creates scheduled task(s)
    PID:4088
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A84AXBNN6A.js"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\A84AXBNN6A.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:1700