vjw0rm | ca4f319704b8e8c93d10e74a8c8ba9760dc4f0ff29ff227ef44aec02bb675d40

General

Target

Custom Clearance Doc. AWB#5305323204643.js
Size

127KB
MD5

ca725f6c53d5cd93cdec59ea14d8493e
SHA1

ca8118f5fa816e134340e114bccf2e2c2c9605b3
SHA256

e83a856d7552c65e3a8ad5f411cfb0193a057de503be751ddd5e85ec42ad2b82
SHA512

4b40a794761d31a70b48993523f8996130f2b612bdf0f0cbef6216981f41ea5f5cb7513e605b954e631664e414bcbf1ff4992abbe5458a886abc312268e07d9f

Score

10^/10

vjw0rm wshrat persistence suricata trojan worm

Malware Config

Extracted

Family

wshrat

C2

http://62.102.148.154:4044

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat
suricata: ET MALWARE WSHRAT CnC Checkin
suricata: ET MALWARE WSHRAT CnC Checkin
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata

Blocklisted process makes network request 59 IoCs

Processes:

wscript.exewscript.exewscript.exe

flow	pid	process
5	2296	wscript.exe
6	1948	wscript.exe
7	1620	wscript.exe
13	2296	wscript.exe
18	1620	wscript.exe
19	1948	wscript.exe
24	2296	wscript.exe
25	2296	wscript.exe
26	1948	wscript.exe
27	1620	wscript.exe
28	2296	wscript.exe
35	1948	wscript.exe
36	1620	wscript.exe
37	2296	wscript.exe
39	2296	wscript.exe
40	1948	wscript.exe
41	1620	wscript.exe
42	2296	wscript.exe
46	2296	wscript.exe
49	1948	wscript.exe
50	1620	wscript.exe
51	2296	wscript.exe
52	1948	wscript.exe
53	1620	wscript.exe
54	2296	wscript.exe
57	2296	wscript.exe
58	1620	wscript.exe
59	1948	wscript.exe
60	2296	wscript.exe
61	2296	wscript.exe
62	1620	wscript.exe
63	1948	wscript.exe
64	2296	wscript.exe
65	1620	wscript.exe
66	1948	wscript.exe
67	2296	wscript.exe
70	2296	wscript.exe
71	1620	wscript.exe
72	1948	wscript.exe
73	2296	wscript.exe
74	2296	wscript.exe
75	1620	wscript.exe
76	1948	wscript.exe
77	2296	wscript.exe
78	1948	wscript.exe
79	1620	wscript.exe
80	2296	wscript.exe
81	2296	wscript.exe
82	1620	wscript.exe
83	1948	wscript.exe
84	2296	wscript.exe
85	1620	wscript.exe
86	1948	wscript.exe
87	2296	wscript.exe
88	2296	wscript.exe
89	1620	wscript.exe
90	1948	wscript.exe
91	2296	wscript.exe
92	2296	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

Processes:

wscript.exewscript.exewscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Custom Clearance Doc. AWB#5305323204643.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Custom Clearance Doc. AWB#5305323204643.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BkhjCIyWPk.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BkhjCIyWPk.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BkhjCIyWPk.js	wscript.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exewscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Custom Clearance Doc = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Custom Clearance Doc. AWB#5305323204643.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Custom Clearance Doc = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Custom Clearance Doc. AWB#5305323204643.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\BkhjCIyWPk.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\BkhjCIyWPk.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Custom Clearance Doc = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Custom Clearance Doc. AWB#5305323204643.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Custom Clearance Doc = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Custom Clearance Doc. AWB#5305323204643.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 27 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	51	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	61	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	64	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	28	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	77	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	80	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	54	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	92	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	57	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	84	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	88	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	13	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	5	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	25	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	37	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	42	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	91	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	46	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	87	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	39	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	60	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	67	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	74	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	81	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	24	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	70	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript
HTTP User-Agent header	73	WSHRAT\|84F3C576\|JVJHUWZP\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 21/6/2022\|JavaScript

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exewscript.exe

description	pid	process	target process
PID 2540 wrote to memory of 1948	2540	wscript.exe	wscript.exe
PID 2540 wrote to memory of 1948	2540	wscript.exe	wscript.exe
PID 2540 wrote to memory of 2296	2540	wscript.exe	wscript.exe
PID 2540 wrote to memory of 2296	2540	wscript.exe	wscript.exe
PID 2296 wrote to memory of 1620	2296	wscript.exe	wscript.exe
PID 2296 wrote to memory of 1620	2296	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Custom Clearance Doc. AWB#5305323204643.js"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2540

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BkhjCIyWPk.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1948

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Custom Clearance Doc. AWB#5305323204643.js"
2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2296

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BkhjCIyWPk.js"
3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1620

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BkhjCIyWPk.js
Filesize
37KB

MD5
863b5a9c6fb45aac728f10cb43fa8a9a

SHA1
216392b8a0821a05137229fd38df6af354d9696a

SHA256
52374610175d7340729819e2e64a88a5f8a973e9f134280740130341f4ac0ec9

SHA512
582db6f1da204e96f892b736e055b40dfd3f5eb5853c01c98c50c8987f7f69007203156341711668ea09126d5d90847c5ec2d1595d2b1ce2fc1dd3255cdb34c1

Download Submit
C:\Users\Admin\AppData\Roaming\BkhjCIyWPk.js
Filesize
37KB

MD5
863b5a9c6fb45aac728f10cb43fa8a9a

SHA1
216392b8a0821a05137229fd38df6af354d9696a

SHA256
52374610175d7340729819e2e64a88a5f8a973e9f134280740130341f4ac0ec9

SHA512
582db6f1da204e96f892b736e055b40dfd3f5eb5853c01c98c50c8987f7f69007203156341711668ea09126d5d90847c5ec2d1595d2b1ce2fc1dd3255cdb34c1

Download Submit
C:\Users\Admin\AppData\Roaming\Custom Clearance Doc. AWB#5305323204643.js
Filesize
127KB

MD5
ca725f6c53d5cd93cdec59ea14d8493e

SHA1
ca8118f5fa816e134340e114bccf2e2c2c9605b3

SHA256
e83a856d7552c65e3a8ad5f411cfb0193a057de503be751ddd5e85ec42ad2b82

SHA512
4b40a794761d31a70b48993523f8996130f2b612bdf0f0cbef6216981f41ea5f5cb7513e605b954e631664e414bcbf1ff4992abbe5458a886abc312268e07d9f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Custom Clearance Doc. AWB#5305323204643.js
Filesize
127KB

MD5
ca725f6c53d5cd93cdec59ea14d8493e

SHA1
ca8118f5fa816e134340e114bccf2e2c2c9605b3

SHA256
e83a856d7552c65e3a8ad5f411cfb0193a057de503be751ddd5e85ec42ad2b82

SHA512
4b40a794761d31a70b48993523f8996130f2b612bdf0f0cbef6216981f41ea5f5cb7513e605b954e631664e414bcbf1ff4992abbe5458a886abc312268e07d9f

Download Submit
memory/1620-134-0x0000000000000000-mapping.dmp

Download
memory/1948-130-0x0000000000000000-mapping.dmp

Download
memory/2296-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads