vjw0rm | cf7adbaa26298ae18a94b2114ea189054cfbd65cf0822a35cccb72261e3c64a7

General

Target

MUIUoftbDe_movar.js
Size

88KB
MD5

d253f7ee481d6769dcad17a0e35e6d09
SHA1

81b889c7d769620bd87839c98ca6a5af230d4170
SHA256

cf7adbaa26298ae18a94b2114ea189054cfbd65cf0822a35cccb72261e3c64a7
SHA512

9e6b91b3ae23b3e67bd942d720527a3264c2f9646a55fb459bd9998af5c17b9801a4c6ada982a792bc86e5b25d8df0dbc54654985d59fc12315cee18dd090d1f
SSDEEP

768:kOWy5gufY8gJ/9HmaRMKveSpfNS04AMoRQSr3zZOTsC7QZFT2WSuv00Bv2c9hfD8:mbRUSdN9MwQSrDxyWSuvwufXGskoOQU

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

C2

http://45.139.105.174:7670

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 36 IoCs

Processes:

wscript.exewscript.exewscript.exe

flow	pid	process
9	852	wscript.exe
10	960	wscript.exe
11	2016	wscript.exe
12	2016	wscript.exe
14	2016	wscript.exe
16	2016	wscript.exe
21	2016	wscript.exe
23	2016	wscript.exe
25	852	wscript.exe
27	960	wscript.exe
28	2016	wscript.exe
30	2016	wscript.exe
32	2016	wscript.exe
35	2016	wscript.exe
38	2016	wscript.exe
40	960	wscript.exe
42	852	wscript.exe
43	2016	wscript.exe
47	2016	wscript.exe
48	2016	wscript.exe
50	2016	wscript.exe
56	2016	wscript.exe
58	852	wscript.exe
59	960	wscript.exe
61	2016	wscript.exe
63	2016	wscript.exe
67	2016	wscript.exe
68	2016	wscript.exe
72	2016	wscript.exe
75	2016	wscript.exe
77	960	wscript.exe
78	852	wscript.exe
80	2016	wscript.exe
81	2016	wscript.exe
84	2016	wscript.exe
85	2016	wscript.exe

Drops startup file 5 IoCs

Processes:

wscript.exewscript.exewscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oDmkpHXKkT.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oDmkpHXKkT.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oDmkpHXKkT.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MUIUoftbDe_movar.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MUIUoftbDe_movar.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MUIUoftbDe_movar = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\MUIUoftbDe_movar.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MUIUoftbDe_movar = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\MUIUoftbDe_movar.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MUIUoftbDe_movar = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\MUIUoftbDe_movar.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MUIUoftbDe_movar = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\MUIUoftbDe_movar.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 26 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	63	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	72	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	75	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	84	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	12	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	28	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	38	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	47	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	56	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	80	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	14	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	16	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	30	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	32	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	43	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	61	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	68	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	81	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	11	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	21	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	23	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	67	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	85	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	35	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	48	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript
HTTP User-Agent header	50	WSHRAT\|5C41F0CB\|ZERMMMDR\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 23/11/2022\|JavaScript

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

wscript.exewscript.exe

description	pid	process	target process
PID 1624 wrote to memory of 960	1624	wscript.exe	wscript.exe
PID 1624 wrote to memory of 960	1624	wscript.exe	wscript.exe
PID 1624 wrote to memory of 960	1624	wscript.exe	wscript.exe
PID 1624 wrote to memory of 2016	1624	wscript.exe	wscript.exe
PID 1624 wrote to memory of 2016	1624	wscript.exe	wscript.exe
PID 1624 wrote to memory of 2016	1624	wscript.exe	wscript.exe
PID 2016 wrote to memory of 852	2016	wscript.exe	wscript.exe
PID 2016 wrote to memory of 852	2016	wscript.exe	wscript.exe
PID 2016 wrote to memory of 852	2016	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MUIUoftbDe_movar.js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\oDmkpHXKkT.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
PID:960

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\MUIUoftbDe_movar.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\oDmkpHXKkT.js"
3⤵
- Blocklisted process makes network request
- Drops startup file
PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MUIUoftbDe_movar.js

Filesize
88KB

MD5
d253f7ee481d6769dcad17a0e35e6d09

SHA1
81b889c7d769620bd87839c98ca6a5af230d4170

SHA256
cf7adbaa26298ae18a94b2114ea189054cfbd65cf0822a35cccb72261e3c64a7

SHA512
9e6b91b3ae23b3e67bd942d720527a3264c2f9646a55fb459bd9998af5c17b9801a4c6ada982a792bc86e5b25d8df0dbc54654985d59fc12315cee18dd090d1f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MUIUoftbDe_movar.js

Filesize
88KB

MD5
d253f7ee481d6769dcad17a0e35e6d09

SHA1
81b889c7d769620bd87839c98ca6a5af230d4170

SHA256
cf7adbaa26298ae18a94b2114ea189054cfbd65cf0822a35cccb72261e3c64a7

SHA512
9e6b91b3ae23b3e67bd942d720527a3264c2f9646a55fb459bd9998af5c17b9801a4c6ada982a792bc86e5b25d8df0dbc54654985d59fc12315cee18dd090d1f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oDmkpHXKkT.js

Filesize
23KB

MD5
2df5ca7cad66ae2bd13b8e4d333c3f00

SHA1
9ed68a832bd2bd20dfd7cbf2c2acc0e7948ea4c8

SHA256
8fb34cb8fbf3cb616b8b878d8bb91f5a0f674ba012e4a27dbb55d63c47225e7e

SHA512
db132b9fc3777cca7225872ef9db53df67fbca2da3bc756b33b5d51e5c89f52b96e8e9fb9772ca74935bb7045cebff6da67c60037d0065e8bc4b99bce14ff8fb

Download Submit
C:\Users\Admin\AppData\Roaming\oDmkpHXKkT.js

Filesize
23KB

MD5
2df5ca7cad66ae2bd13b8e4d333c3f00

SHA1
9ed68a832bd2bd20dfd7cbf2c2acc0e7948ea4c8

SHA256
8fb34cb8fbf3cb616b8b878d8bb91f5a0f674ba012e4a27dbb55d63c47225e7e

SHA512
db132b9fc3777cca7225872ef9db53df67fbca2da3bc756b33b5d51e5c89f52b96e8e9fb9772ca74935bb7045cebff6da67c60037d0065e8bc4b99bce14ff8fb

Download Submit
C:\Users\Admin\AppData\Roaming\oDmkpHXKkT.js

Filesize
23KB

MD5
2df5ca7cad66ae2bd13b8e4d333c3f00

SHA1
9ed68a832bd2bd20dfd7cbf2c2acc0e7948ea4c8

SHA256
8fb34cb8fbf3cb616b8b878d8bb91f5a0f674ba012e4a27dbb55d63c47225e7e

SHA512
db132b9fc3777cca7225872ef9db53df67fbca2da3bc756b33b5d51e5c89f52b96e8e9fb9772ca74935bb7045cebff6da67c60037d0065e8bc4b99bce14ff8fb

Download Submit
memory/852-60-0x0000000000000000-mapping.dmp

Download
memory/960-55-0x0000000000000000-mapping.dmp

Download
memory/1624-54-0x000007FEFBA01000-0x000007FEFBA03000-memory.dmp

Filesize
8KB

Download
memory/2016-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads