Malware Analysis Report

2025-01-18 12:21

Sample ID 221031-vmfm2sbed5
Target PO. AND FULL COMPANY DETAILS.js
SHA256 22f2f984996706f3bfdfaa95016c163d00764601cfef3a0ee7691f361f1b0bed
Tags
vjw0rm wshrat persistence trojan worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

22f2f984996706f3bfdfaa95016c163d00764601cfef3a0ee7691f361f1b0bed

Threat Level: Known bad

The file PO. AND FULL COMPANY DETAILS.js was found to be: Known bad.

Malicious Activity Summary

vjw0rm wshrat persistence trojan worm

Vjw0rm

WSHRAT

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Script User-Agent

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-31 17:06

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-31 17:06

Reported

2022-10-31 17:09

Platform

win7-20220812-en

Max time kernel

150s

Max time network

178s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO. AND FULL COMPANY DETAILS.js"

Signatures

Vjw0rm

trojan worm vjw0rm

WSHRAT

trojan wshrat

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO. AND FULL COMPANY DETAILS.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO. AND FULL COMPANY DETAILS.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KkAJQFWrPZ.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KkAJQFWrPZ.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KkAJQFWrPZ.js C:\Windows\System32\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO. AND FULL COMPANY DETAILS.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO. AND FULL COMPANY DETAILS.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO. AND FULL COMPANY DETAILS.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO. AND FULL COMPANY DETAILS.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|5C41F0CB|ZERMMMDR|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 31/10/2022|JavaScript N/A N/A

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO. AND FULL COMPANY DETAILS.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\KkAJQFWrPZ.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PO. AND FULL COMPANY DETAILS.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\KkAJQFWrPZ.js"

Network

Country Destination Domain Proto
US 8.8.8.8:53 javaautorun.duia.ro udp
US 8.8.8.8:53 javaautorun.duia.ro udp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
EE 91.193.75.135:2120 91.193.75.135 tcp

Files

memory/904-54-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

memory/1752-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\KkAJQFWrPZ.js

MD5 55e53bf999e8da52880af2e3eb145dd7
SHA1 eb3cb8113ac5bdbd28884a5ec8f8486ab1579ea7
SHA256 ce43f09fa4934454576496833efc115ca2872e0163e0a7cba1a20ed8b1af1a06
SHA512 9141ce714b512f497355d1ce7fce407a47d6dad5434ae05311cc2a745cc84f7394eeb5ce1750b5831ca772e3486a446470cba66ecfd62f77299da6cd06616eda

memory/1992-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\PO. AND FULL COMPANY DETAILS.js

MD5 8bc16b0d732b50f86fedb1f18bb0a49a
SHA1 3f0fc1ebce788f408926e5776e290374f380e072
SHA256 22f2f984996706f3bfdfaa95016c163d00764601cfef3a0ee7691f361f1b0bed
SHA512 9f4001740b63e8b4a53655b84c5b432f1d07f82eae60062d244ff25a43699b64bb1c9d4675ef97e2db50ab66dfac27b6e1ea7013527bac48566e7a22ebfb5d1e

memory/1764-60-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO. AND FULL COMPANY DETAILS.js

MD5 8bc16b0d732b50f86fedb1f18bb0a49a
SHA1 3f0fc1ebce788f408926e5776e290374f380e072
SHA256 22f2f984996706f3bfdfaa95016c163d00764601cfef3a0ee7691f361f1b0bed
SHA512 9f4001740b63e8b4a53655b84c5b432f1d07f82eae60062d244ff25a43699b64bb1c9d4675ef97e2db50ab66dfac27b6e1ea7013527bac48566e7a22ebfb5d1e

C:\Users\Admin\AppData\Roaming\KkAJQFWrPZ.js

MD5 55e53bf999e8da52880af2e3eb145dd7
SHA1 eb3cb8113ac5bdbd28884a5ec8f8486ab1579ea7
SHA256 ce43f09fa4934454576496833efc115ca2872e0163e0a7cba1a20ed8b1af1a06
SHA512 9141ce714b512f497355d1ce7fce407a47d6dad5434ae05311cc2a745cc84f7394eeb5ce1750b5831ca772e3486a446470cba66ecfd62f77299da6cd06616eda

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-31 17:06

Reported

2022-10-31 17:08

Platform

win10v2004-20220901-en

Max time kernel

146s

Max time network

152s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO. AND FULL COMPANY DETAILS.js"

Signatures

Vjw0rm

trojan worm vjw0rm

WSHRAT

trojan wshrat

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Windows\System32\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO. AND FULL COMPANY DETAILS.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO. AND FULL COMPANY DETAILS.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KkAJQFWrPZ.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KkAJQFWrPZ.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KkAJQFWrPZ.js C:\Windows\System32\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO. AND FULL COMPANY DETAILS.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO. AND FULL COMPANY DETAILS.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO. AND FULL COMPANY DETAILS.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO. AND FULL COMPANY DETAILS.js\"" C:\Windows\System32\wscript.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|36F4858E|IYMUGYHL|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 31/10/2022|JavaScript N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4788 wrote to memory of 4116 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 4788 wrote to memory of 4116 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 4788 wrote to memory of 740 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 4788 wrote to memory of 740 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 740 wrote to memory of 3192 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe
PID 740 wrote to memory of 3192 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO. AND FULL COMPANY DETAILS.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\KkAJQFWrPZ.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PO. AND FULL COMPANY DETAILS.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\KkAJQFWrPZ.js"

Network

Country Destination Domain Proto
EE 91.193.75.135:2120 91.193.75.135 tcp
US 8.8.8.8:53 javaautorun.duia.ro udp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
US 20.42.65.84:443 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
US 93.184.221.240:80 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
NL 104.80.229.204:443 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
EE 91.193.75.135:2120 91.193.75.135 tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
CZ 5.62.61.61:5465 javaautorun.duia.ro tcp
EE 91.193.75.135:2120 91.193.75.135 tcp

Files

memory/4116-132-0x0000000000000000-mapping.dmp

memory/740-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\KkAJQFWrPZ.js

MD5 55e53bf999e8da52880af2e3eb145dd7
SHA1 eb3cb8113ac5bdbd28884a5ec8f8486ab1579ea7
SHA256 ce43f09fa4934454576496833efc115ca2872e0163e0a7cba1a20ed8b1af1a06
SHA512 9141ce714b512f497355d1ce7fce407a47d6dad5434ae05311cc2a745cc84f7394eeb5ce1750b5831ca772e3486a446470cba66ecfd62f77299da6cd06616eda

C:\Users\Admin\AppData\Roaming\PO. AND FULL COMPANY DETAILS.js

MD5 8bc16b0d732b50f86fedb1f18bb0a49a
SHA1 3f0fc1ebce788f408926e5776e290374f380e072
SHA256 22f2f984996706f3bfdfaa95016c163d00764601cfef3a0ee7691f361f1b0bed
SHA512 9f4001740b63e8b4a53655b84c5b432f1d07f82eae60062d244ff25a43699b64bb1c9d4675ef97e2db50ab66dfac27b6e1ea7013527bac48566e7a22ebfb5d1e

memory/3192-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO. AND FULL COMPANY DETAILS.js

MD5 8bc16b0d732b50f86fedb1f18bb0a49a
SHA1 3f0fc1ebce788f408926e5776e290374f380e072
SHA256 22f2f984996706f3bfdfaa95016c163d00764601cfef3a0ee7691f361f1b0bed
SHA512 9f4001740b63e8b4a53655b84c5b432f1d07f82eae60062d244ff25a43699b64bb1c9d4675ef97e2db50ab66dfac27b6e1ea7013527bac48566e7a22ebfb5d1e

C:\Users\Admin\AppData\Roaming\KkAJQFWrPZ.js

MD5 55e53bf999e8da52880af2e3eb145dd7
SHA1 eb3cb8113ac5bdbd28884a5ec8f8486ab1579ea7
SHA256 ce43f09fa4934454576496833efc115ca2872e0163e0a7cba1a20ed8b1af1a06
SHA512 9141ce714b512f497355d1ce7fce407a47d6dad5434ae05311cc2a745cc84f7394eeb5ce1750b5831ca772e3486a446470cba66ecfd62f77299da6cd06616eda

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KkAJQFWrPZ.js

MD5 55e53bf999e8da52880af2e3eb145dd7
SHA1 eb3cb8113ac5bdbd28884a5ec8f8486ab1579ea7
SHA256 ce43f09fa4934454576496833efc115ca2872e0163e0a7cba1a20ed8b1af1a06
SHA512 9141ce714b512f497355d1ce7fce407a47d6dad5434ae05311cc2a745cc84f7394eeb5ce1750b5831ca772e3486a446470cba66ecfd62f77299da6cd06616eda