Malware Analysis Report

2025-01-18 12:23

Sample ID 221109-rmtywshfa4
Target Quotation Request.js
SHA256 ee442f3b315081d57f588d3a260b3f6b53a374113ef6de989250b8a36cc131e2
Tags
vjw0rm wshrat persistence trojan worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ee442f3b315081d57f588d3a260b3f6b53a374113ef6de989250b8a36cc131e2

Threat Level: Known bad

The file Quotation Request.js was found to be: Known bad.

Malicious Activity Summary

vjw0rm wshrat persistence trojan worm

Vjw0rm

WSHRAT

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Script User-Agent

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-09 14:19

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-09 14:19

Reported

2022-11-09 14:21

Platform

win10v2004-20220812-en

Max time kernel

149s

Max time network

154s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quotation Request.js"

Signatures

Vjw0rm

trojan worm vjw0rm

WSHRAT

trojan wshrat

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Windows\system32\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Windows\System32\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js C:\Windows\System32\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" C:\Windows\System32\wscript.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|2C4BFA22|XZIOFAVD|Admin|Microsoft Windows 10 Pro|plus|nan-av|false - 9/11/2022|JavaScript N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2776 wrote to memory of 4480 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2776 wrote to memory of 4480 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2776 wrote to memory of 5024 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 2776 wrote to memory of 5024 N/A C:\Windows\system32\wscript.exe C:\Windows\System32\wscript.exe
PID 5024 wrote to memory of 4588 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe
PID 5024 wrote to memory of 4588 N/A C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quotation Request.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Quotation Request.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js"

Network

Country Destination Domain Proto
US 8.8.8.8:53 javaautorun.duia.ro udp
US 8.8.8.8:53 kmajewska.duckdns.org udp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 93.184.220.29:80 tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
NL 67.26.111.254:80 tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
NL 67.26.111.254:80 tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp

Files

memory/4480-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js

MD5 54a1c2c82989d556e1c1e0403f70f93c
SHA1 f0f836feb62397bcc95991557738e872d12bed05
SHA256 e48d325c213c149da8dadd739c0e5279b1fadac980ece81346a883fecbabfe6b
SHA512 035225c2fd4ca0fe8972bd26cdfc2f1580f9bc4826193e3f273f66b0d8675ee24181935a6b0d7dce4fbde2768f4b0f5dea90f151084812edee59609a0adfdba2

memory/5024-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Quotation Request.js

MD5 9f09acf3f30f2b09d7509a7eda87a14e
SHA1 d833eb8a70209454b68df1fcd10c54832298231f
SHA256 ee442f3b315081d57f588d3a260b3f6b53a374113ef6de989250b8a36cc131e2
SHA512 9413f70f28f039d60e5dc0ad7edbcf87aa73e8ab317c45616eb612ebdd80e8f6465992d43b738af9560fbe718221b616de977eac6ee5d6fb4cd65807ae9ffff1

memory/4588-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js

MD5 9f09acf3f30f2b09d7509a7eda87a14e
SHA1 d833eb8a70209454b68df1fcd10c54832298231f
SHA256 ee442f3b315081d57f588d3a260b3f6b53a374113ef6de989250b8a36cc131e2
SHA512 9413f70f28f039d60e5dc0ad7edbcf87aa73e8ab317c45616eb612ebdd80e8f6465992d43b738af9560fbe718221b616de977eac6ee5d6fb4cd65807ae9ffff1

C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js

MD5 54a1c2c82989d556e1c1e0403f70f93c
SHA1 f0f836feb62397bcc95991557738e872d12bed05
SHA256 e48d325c213c149da8dadd739c0e5279b1fadac980ece81346a883fecbabfe6b
SHA512 035225c2fd4ca0fe8972bd26cdfc2f1580f9bc4826193e3f273f66b0d8675ee24181935a6b0d7dce4fbde2768f4b0f5dea90f151084812edee59609a0adfdba2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js

MD5 54a1c2c82989d556e1c1e0403f70f93c
SHA1 f0f836feb62397bcc95991557738e872d12bed05
SHA256 e48d325c213c149da8dadd739c0e5279b1fadac980ece81346a883fecbabfe6b
SHA512 035225c2fd4ca0fe8972bd26cdfc2f1580f9bc4826193e3f273f66b0d8675ee24181935a6b0d7dce4fbde2768f4b0f5dea90f151084812edee59609a0adfdba2

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-09 14:19

Reported

2022-11-09 14:21

Platform

win7-20220812-en

Max time kernel

149s

Max time network

158s

Command Line

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quotation Request.js"

Signatures

Vjw0rm

trojan worm vjw0rm

WSHRAT

trojan wshrat

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A
N/A N/A C:\Windows\System32\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js C:\Windows\System32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js C:\Windows\system32\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js C:\Windows\System32\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js C:\Windows\System32\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\system32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" C:\Windows\System32\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run C:\Windows\System32\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\"" C:\Windows\System32\wscript.exe N/A

Enumerates physical storage devices

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A
HTTP User-Agent header WSHRAT|D44DAEDB|ORXGKKZC|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 9/11/2022|JavaScript N/A N/A

Processes

C:\Windows\system32\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quotation Request.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Quotation Request.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js"

Network

Country Destination Domain Proto
US 8.8.8.8:53 javaautorun.duia.ro udp
US 8.8.8.8:53 kmajewska.duckdns.org udp
US 8.8.8.8:53 javaautorun.duia.ro udp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
US 5.62.56.23:5465 javaautorun.duia.ro tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp
CH 79.134.225.100:2556 kmajewska.duckdns.org tcp

Files

memory/2044-54-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

memory/996-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js

MD5 54a1c2c82989d556e1c1e0403f70f93c
SHA1 f0f836feb62397bcc95991557738e872d12bed05
SHA256 e48d325c213c149da8dadd739c0e5279b1fadac980ece81346a883fecbabfe6b
SHA512 035225c2fd4ca0fe8972bd26cdfc2f1580f9bc4826193e3f273f66b0d8675ee24181935a6b0d7dce4fbde2768f4b0f5dea90f151084812edee59609a0adfdba2

memory/1608-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Quotation Request.js

MD5 9f09acf3f30f2b09d7509a7eda87a14e
SHA1 d833eb8a70209454b68df1fcd10c54832298231f
SHA256 ee442f3b315081d57f588d3a260b3f6b53a374113ef6de989250b8a36cc131e2
SHA512 9413f70f28f039d60e5dc0ad7edbcf87aa73e8ab317c45616eb612ebdd80e8f6465992d43b738af9560fbe718221b616de977eac6ee5d6fb4cd65807ae9ffff1

memory/1836-60-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js

MD5 9f09acf3f30f2b09d7509a7eda87a14e
SHA1 d833eb8a70209454b68df1fcd10c54832298231f
SHA256 ee442f3b315081d57f588d3a260b3f6b53a374113ef6de989250b8a36cc131e2
SHA512 9413f70f28f039d60e5dc0ad7edbcf87aa73e8ab317c45616eb612ebdd80e8f6465992d43b738af9560fbe718221b616de977eac6ee5d6fb4cd65807ae9ffff1

C:\Users\Admin\AppData\Roaming\WskhhfIfpv.js

MD5 54a1c2c82989d556e1c1e0403f70f93c
SHA1 f0f836feb62397bcc95991557738e872d12bed05
SHA256 e48d325c213c149da8dadd739c0e5279b1fadac980ece81346a883fecbabfe6b
SHA512 035225c2fd4ca0fe8972bd26cdfc2f1580f9bc4826193e3f273f66b0d8675ee24181935a6b0d7dce4fbde2768f4b0f5dea90f151084812edee59609a0adfdba2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WskhhfIfpv.js

MD5 54a1c2c82989d556e1c1e0403f70f93c
SHA1 f0f836feb62397bcc95991557738e872d12bed05
SHA256 e48d325c213c149da8dadd739c0e5279b1fadac980ece81346a883fecbabfe6b
SHA512 035225c2fd4ca0fe8972bd26cdfc2f1580f9bc4826193e3f273f66b0d8675ee24181935a6b0d7dce4fbde2768f4b0f5dea90f151084812edee59609a0adfdba2