vjw0rm | 1f8960fefec1f88953f7a39c21724c732a257554a93c875d42bc1c45f1bae824

General

Target

LPO-17-006AD.js
Size

46KB
MD5

39ebb40e7ee6c296d7b1a9bbb4bbbcd0
SHA1

5f902618378e2b6b8de9248cc5b66fb97dc9c597
SHA256

1f8960fefec1f88953f7a39c21724c732a257554a93c875d42bc1c45f1bae824
SHA512

87828b59c8c2dd03199ae4da5832203ba27d9662ebeb69e8a6300ae9d21df658424ba465ec13e17a04b772ce6fa89190c78dd9ca765cd538297f4378aaa3077d
SSDEEP

768:NZLtbhEL68CUNTwpDfBDSQgl99Yi2e69KfDake7sgQGjnS/6IJnXBn0iNtY:5+e8/CDfBDBaJg9XkSsSYBns

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

C2

http://45.139.105.174:2070

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 21 IoCs

Processes:

wscript.exewscript.exewscript.exe

flow	pid	process
5	4848	wscript.exe
7	1152	wscript.exe
8	5060	wscript.exe
10	4848	wscript.exe
16	5060	wscript.exe
17	1152	wscript.exe
22	4848	wscript.exe
35	5060	wscript.exe
36	1152	wscript.exe
37	4848	wscript.exe
45	5060	wscript.exe
46	1152	wscript.exe
47	4848	wscript.exe
48	4848	wscript.exe
55	5060	wscript.exe
56	1152	wscript.exe
57	4848	wscript.exe
59	4848	wscript.exe
63	5060	wscript.exe
64	1152	wscript.exe
71	4848	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

Processes:

wscript.exewscript.exewscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LPO-17-006AD.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uGIeVawdbu.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uGIeVawdbu.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LPO-17-006AD.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uGIeVawdbu.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LPO-17-006AD = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\LPO-17-006AD.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LPO-17-006AD = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\LPO-17-006AD.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LPO-17-006AD = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\LPO-17-006AD.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LPO-17-006AD = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\LPO-17-006AD.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	5	WSHRAT\|18024990\|TMKNGOMU\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/11/2022\|JavaScript
HTTP User-Agent header	47	WSHRAT\|18024990\|TMKNGOMU\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/11/2022\|JavaScript
HTTP User-Agent header	57	WSHRAT\|18024990\|TMKNGOMU\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/11/2022\|JavaScript
HTTP User-Agent header	71	WSHRAT\|18024990\|TMKNGOMU\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/11/2022\|JavaScript

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exewscript.exe

description	pid	process	target process
PID 2080 wrote to memory of 1152	2080	wscript.exe	wscript.exe
PID 2080 wrote to memory of 1152	2080	wscript.exe	wscript.exe
PID 2080 wrote to memory of 4848	2080	wscript.exe	wscript.exe
PID 2080 wrote to memory of 4848	2080	wscript.exe	wscript.exe
PID 4848 wrote to memory of 5060	4848	wscript.exe	wscript.exe
PID 4848 wrote to memory of 5060	4848	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\LPO-17-006AD.js
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\uGIeVawdbu.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
PID:1152

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\LPO-17-006AD.js"
2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4848

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\uGIeVawdbu.js"
3⤵
- Blocklisted process makes network request
- Drops startup file
PID:5060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\LPO-17-006AD.js
Filesize
46KB

MD5
39ebb40e7ee6c296d7b1a9bbb4bbbcd0

SHA1
5f902618378e2b6b8de9248cc5b66fb97dc9c597

SHA256
1f8960fefec1f88953f7a39c21724c732a257554a93c875d42bc1c45f1bae824

SHA512
87828b59c8c2dd03199ae4da5832203ba27d9662ebeb69e8a6300ae9d21df658424ba465ec13e17a04b772ce6fa89190c78dd9ca765cd538297f4378aaa3077d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LPO-17-006AD.js
Filesize
46KB

MD5
39ebb40e7ee6c296d7b1a9bbb4bbbcd0

SHA1
5f902618378e2b6b8de9248cc5b66fb97dc9c597

SHA256
1f8960fefec1f88953f7a39c21724c732a257554a93c875d42bc1c45f1bae824

SHA512
87828b59c8c2dd03199ae4da5832203ba27d9662ebeb69e8a6300ae9d21df658424ba465ec13e17a04b772ce6fa89190c78dd9ca765cd538297f4378aaa3077d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uGIeVawdbu.js
Filesize
8KB

MD5
ea0d77b36ac9cf8c6cdc5b6036926b2d

SHA1
0e57942ff644e2fd66aa94c1cf0f8007f0fd57a5

SHA256
43038d29162c4df4f2e0aedb0c0ecde9b16ce3fe85c248c45ee215b6cee5b776

SHA512
9328bdeb68046519d74c46c321a496832fe601b1d7ee853e160db2042e1a88b7cbfd0eee8474e262a5a5c0f28f9bdf97bf7eefb07265123ce6e0e1874eada887

Download Submit
C:\Users\Admin\AppData\Roaming\uGIeVawdbu.js
Filesize
8KB

MD5
ea0d77b36ac9cf8c6cdc5b6036926b2d

SHA1
0e57942ff644e2fd66aa94c1cf0f8007f0fd57a5

SHA256
43038d29162c4df4f2e0aedb0c0ecde9b16ce3fe85c248c45ee215b6cee5b776

SHA512
9328bdeb68046519d74c46c321a496832fe601b1d7ee853e160db2042e1a88b7cbfd0eee8474e262a5a5c0f28f9bdf97bf7eefb07265123ce6e0e1874eada887

Download Submit
C:\Users\Admin\AppData\Roaming\uGIeVawdbu.js
Filesize
8KB

MD5
ea0d77b36ac9cf8c6cdc5b6036926b2d

SHA1
0e57942ff644e2fd66aa94c1cf0f8007f0fd57a5

SHA256
43038d29162c4df4f2e0aedb0c0ecde9b16ce3fe85c248c45ee215b6cee5b776

SHA512
9328bdeb68046519d74c46c321a496832fe601b1d7ee853e160db2042e1a88b7cbfd0eee8474e262a5a5c0f28f9bdf97bf7eefb07265123ce6e0e1874eada887

Download Submit
memory/1152-132-0x0000000000000000-mapping.dmp

Download
memory/4848-134-0x0000000000000000-mapping.dmp

Download
memory/5060-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads