vjw0rm | ae5f01695d046a56eb08b76363f51320921fd6ac021ec057d90785d976832c34

General

Target

Quotation Request.js
Size

42KB
MD5

c345961a64e6bf1dd83dea9418c2323a
SHA1

b2edb5c1c41415a1b1f50a809c1b528008bdcf38
SHA256

ae5f01695d046a56eb08b76363f51320921fd6ac021ec057d90785d976832c34
SHA512

9f0d32cd2b0f8f51deabf0e79d60cb8068ab9075d84b4b08d184e9266b6d55b779dfc8e8d49988b3efb6f14b08950f922b64342287fe736acf77b32aa7507f91
SSDEEP

768:NYN31nEZlOxsDSBppfF3GVk4v4ccO/fD3lzo1r8IYOz27s:e0IdBDtGVmEflMoIYOiQ

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

C2

http://185.246.220.208:5358

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 27 IoCs

flow	pid	Process
29	4068	wscript.exe
31	4356	wscript.exe
32	1560	wscript.exe
52	4068	wscript.exe
58	1560	wscript.exe
59	4356	wscript.exe
75	4068	wscript.exe
84	4356	wscript.exe
85	1560	wscript.exe
91	4068	wscript.exe
92	4068	wscript.exe
98	1560	wscript.exe
99	4356	wscript.exe
100	4068	wscript.exe
101	4068	wscript.exe
108	4068	wscript.exe
109	4068	wscript.exe
110	1560	wscript.exe
111	4068	wscript.exe
112	4356	wscript.exe
113	4068	wscript.exe
114	4068	wscript.exe
115	4068	wscript.exe
116	4068	wscript.exe
117	1560	wscript.exe
118	4068	wscript.exe
119	4356	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dlaOuRctgb.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dlaOuRctgb.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dlaOuRctgb.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 13 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	114	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	115	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	116	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	91	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	92	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	101	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	109	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	111	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	118	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	29	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	100	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	108	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	113	WSHRAT\|CAC17A11\|SOCAAGDT\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 4356	632	wscript.exe	83
PID 632 wrote to memory of 4356	632	wscript.exe	83
PID 632 wrote to memory of 4068	632	wscript.exe	84
PID 632 wrote to memory of 4068	632	wscript.exe	84
PID 4068 wrote to memory of 1560	4068	wscript.exe	85
PID 4068 wrote to memory of 1560	4068	wscript.exe	85

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quotation Request.js"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:4356
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Quotation Request.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js

Filesize
42KB

MD5
c345961a64e6bf1dd83dea9418c2323a

SHA1
b2edb5c1c41415a1b1f50a809c1b528008bdcf38

SHA256
ae5f01695d046a56eb08b76363f51320921fd6ac021ec057d90785d976832c34

SHA512
9f0d32cd2b0f8f51deabf0e79d60cb8068ab9075d84b4b08d184e9266b6d55b779dfc8e8d49988b3efb6f14b08950f922b64342287fe736acf77b32aa7507f91

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dlaOuRctgb.js

Filesize
7KB

MD5
6ec157e9bc6512caa18d2c4d438bceff

SHA1
c16435aa60bd5ffda8546a18233c3f6c521a9f1e

SHA256
73ece740572017a0a3ed9e88f1a8169796690606ed5284db979fd975c774bf44

SHA512
ccf524745228ae4dda399a7d3e3f78f285233d88ca7ae28bdd306b820f7a2799c18387f75cf0a3a995d52ea8dfc529d7e940ce8e54a41ab51e22fc97644bfd44

Download Submit
C:\Users\Admin\AppData\Roaming\Quotation Request.js

Filesize
42KB

MD5
c345961a64e6bf1dd83dea9418c2323a

SHA1
b2edb5c1c41415a1b1f50a809c1b528008bdcf38

SHA256
ae5f01695d046a56eb08b76363f51320921fd6ac021ec057d90785d976832c34

SHA512
9f0d32cd2b0f8f51deabf0e79d60cb8068ab9075d84b4b08d184e9266b6d55b779dfc8e8d49988b3efb6f14b08950f922b64342287fe736acf77b32aa7507f91

Download Submit
C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js

Filesize
7KB

MD5
6ec157e9bc6512caa18d2c4d438bceff

SHA1
c16435aa60bd5ffda8546a18233c3f6c521a9f1e

SHA256
73ece740572017a0a3ed9e88f1a8169796690606ed5284db979fd975c774bf44

SHA512
ccf524745228ae4dda399a7d3e3f78f285233d88ca7ae28bdd306b820f7a2799c18387f75cf0a3a995d52ea8dfc529d7e940ce8e54a41ab51e22fc97644bfd44

Download Submit
C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js

Filesize
7KB

MD5
6ec157e9bc6512caa18d2c4d438bceff

SHA1
c16435aa60bd5ffda8546a18233c3f6c521a9f1e

SHA256
73ece740572017a0a3ed9e88f1a8169796690606ed5284db979fd975c774bf44

SHA512
ccf524745228ae4dda399a7d3e3f78f285233d88ca7ae28bdd306b820f7a2799c18387f75cf0a3a995d52ea8dfc529d7e940ce8e54a41ab51e22fc97644bfd44

Download Submit

Analysis

Sharing