vjw0rm | acbd5ccfb8d60783405dd96a626ef0f1752b1676fbe813e1b95a592229598a49

General

Target

Documents for your perusal.js
Size

102KB
MD5

1b74efa2c0b35138eca8ecdfa3eba6e0
SHA1

e324b86548391b74f204ee8f338aaf346c8f041e
SHA256

acbd5ccfb8d60783405dd96a626ef0f1752b1676fbe813e1b95a592229598a49
SHA512

3e2555900a56cbd4c2b160c034700818a7a7397eed49ee3d1d3c47b72dedc435ee42789992947c52e62327b26cdf5f8ccd7fc37c45d28f56d2d05b5a13feebbd

Score

10^/10

vjw0rm wshrat persistence suricata trojan worm

Malware Config

Extracted

Family

wshrat

C2

http://79.134.225.5:8443

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat
suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata

Blocklisted process makes network request 37 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
6	1548	wscript.exe
7	1836	wscript.exe
8	1836	wscript.exe
10	1548	wscript.exe
11	1836	wscript.exe
13	1548	wscript.exe
15	1836	wscript.exe
17	1836	wscript.exe
18	1548	wscript.exe
20	1836	wscript.exe
24	1548	wscript.exe
25	1836	wscript.exe
26	1836	wscript.exe
28	1548	wscript.exe
30	1836	wscript.exe
32	1836	wscript.exe
33	1548	wscript.exe
35	1836	wscript.exe
37	1548	wscript.exe
38	1836	wscript.exe
41	1548	wscript.exe
43	1836	wscript.exe
44	1836	wscript.exe
45	1548	wscript.exe
47	1836	wscript.exe
49	1548	wscript.exe
51	1836	wscript.exe
52	1836	wscript.exe
53	1548	wscript.exe
55	1836	wscript.exe
58	1836	wscript.exe
59	1548	wscript.exe
62	1548	wscript.exe
63	1548	wscript.exe
66	1836	wscript.exe
67	1836	wscript.exe
68	1548	wscript.exe

Drops startup file 4 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Documents for your perusal.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Documents for your perusal.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PIyMVuMvgS.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PIyMVuMvgS.js	wscript.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Documents for your perusal = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Documents for your perusal.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Documents for your perusal = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Documents for your perusal.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\PIyMVuMvgS.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 20 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	8	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	11	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	15	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	30	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	51	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	7	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	26	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	38	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	43	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	47	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	25	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	32	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	55	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	67	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	66	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	17	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	20	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	35	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	44	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript
HTTP User-Agent header	52	WSHRAT\|A8C4AD38\|WYZSGDWS\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 17/6/2022\|JavaScript

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1836 wrote to memory of 1548	1836	wscript.exe	wscript.exe
PID 1836 wrote to memory of 1548	1836	wscript.exe	wscript.exe
PID 1836 wrote to memory of 1548	1836	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Documents for your perusal.js"
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PIyMVuMvgS.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\PIyMVuMvgS.js
Filesize
28KB

MD5
204ace6f24d40310b7ad4ba7c158230b

SHA1
c97cb43e319376c167dd51712d0e538477791786

SHA256
45e553d318f844c7b08b1255965d0263bb6f93ead4e870ca5059e43b73eb9a01

SHA512
a4ef9a7e6cd0123aa760dfe1f87c8d67a846918b59ac2bc393cf63e7f31b675fd979658ab6a9c60ceaeeb4c1a8e8ed2cccf2033ded22a544489e1ea597e167e2

Download Submit
memory/1548-55-0x0000000000000000-mapping.dmp

Download
memory/1836-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads