vjw0rm | 6b12cfb0d109c8944d64556320bb63e2b0a287b8583c16cc4eb3b32f86fe31c8

General

Target

PO.js
Size

5KB
MD5

2847ee58cb7ef2bc9d410ad73a15961f
SHA1

701a342c49ec6d2c802847157e6a68154168bbf8
SHA256

6b12cfb0d109c8944d64556320bb63e2b0a287b8583c16cc4eb3b32f86fe31c8
SHA512

3245868c4700d28843fc98e6e15eefc269da745b334bc3678f1710d1a7520305bfd5dc2c2cc87ebdd6e114f850eebcb69b55d3f2297d560b5d55621203ee78e6
SSDEEP

96:u9GyFqVgE4DBLSjsg2B7pikxVHFQba/40zpzw4wu+huzLsFZZRKC8CEsrYcshAiR:VuEgBOwZFiO+a/40zNw4wFSLYZRHEsrs

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

vjw0rm

C2

http://212.193.30.230:6505

Extracted

Family

wshrat

C2

http://212.193.30.230:7780

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 5 IoCs

flow	pid	Process
2	4816	wscript.exe
41	4428	wscript.exe
42	4428	wscript.exe
43	4428	wscript.exe
44	4428	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MM456F833Q.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MM456F833Q.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO.js	wscript.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MM456F833Q = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\MM456F833Q.js\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MM456F833Q = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\MM456F833Q.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MM456F833Q = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\MM456F833Q.js\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MM456F833Q = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\MM456F833Q.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2JZFR52JWJ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	wscript.exe

Script User-Agent 8 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	44	WSHRAT\|94D95F5C\|GBQHURCC\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 1/11/2022\|JavaScript
HTTP User-Agent header	45	WSHRAT\|94D95F5C\|GBQHURCC\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 1/11/2022\|JavaScript
HTTP User-Agent header	46	WSHRAT\|94D95F5C\|GBQHURCC\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 1/11/2022\|JavaScript
HTTP User-Agent header	47	WSHRAT\|94D95F5C\|GBQHURCC\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 1/11/2022\|JavaScript
HTTP User-Agent header	48	WSHRAT\|94D95F5C\|GBQHURCC\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 1/11/2022\|JavaScript
HTTP User-Agent header	41	WSHRAT\|94D95F5C\|GBQHURCC\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 1/11/2022\|JavaScript
HTTP User-Agent header	42	WSHRAT\|94D95F5C\|GBQHURCC\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 1/11/2022\|JavaScript
HTTP User-Agent header	43	WSHRAT\|94D95F5C\|GBQHURCC\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 1/11/2022\|JavaScript

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4404	4816	wscript.exe	86
PID 4816 wrote to memory of 4404	4816	wscript.exe	86
PID 4404 wrote to memory of 4428	4404	WScript.exe	87
PID 4404 wrote to memory of 4428	4404	WScript.exe	87

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MM456F833Q.js"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\MM456F833Q.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:4428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MM456F833Q.js

Filesize
24KB

MD5
963ca126766bbcd9e8384b9ef2c74673

SHA1
59ac9982bde3dcf4d4a89e99b8ab08fedce02ba5

SHA256
7549db05702b59ca48c9faaab687273bbe8abad0c8d27540ca89f63ed3c9ed5a

SHA512
0df472aa3d72ab2cb7269eb55c3b4a05a3b654a280ccec9f5bd10f6dca07d98ea9c3cb0be101fa5ad973fa718e16c0605ac4a4d8e94952b18140f4c9394d2480

Download Submit
C:\Users\Admin\AppData\Roaming\MM456F833Q.js

Filesize
24KB

MD5
963ca126766bbcd9e8384b9ef2c74673

SHA1
59ac9982bde3dcf4d4a89e99b8ab08fedce02ba5

SHA256
7549db05702b59ca48c9faaab687273bbe8abad0c8d27540ca89f63ed3c9ed5a

SHA512
0df472aa3d72ab2cb7269eb55c3b4a05a3b654a280ccec9f5bd10f6dca07d98ea9c3cb0be101fa5ad973fa718e16c0605ac4a4d8e94952b18140f4c9394d2480

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MM456F833Q.js

Filesize
24KB

MD5
963ca126766bbcd9e8384b9ef2c74673

SHA1
59ac9982bde3dcf4d4a89e99b8ab08fedce02ba5

SHA256
7549db05702b59ca48c9faaab687273bbe8abad0c8d27540ca89f63ed3c9ed5a

SHA512
0df472aa3d72ab2cb7269eb55c3b4a05a3b654a280ccec9f5bd10f6dca07d98ea9c3cb0be101fa5ad973fa718e16c0605ac4a4d8e94952b18140f4c9394d2480

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads