vjw0rm | abb83301f8ec06fd4bb89cbe4efd509acaef3b24f87e995b6f631943b9b1454b

General

Target

Quotation Request.js
Size

42KB
MD5

c345961a64e6bf1dd83dea9418c2323a
SHA1

b2edb5c1c41415a1b1f50a809c1b528008bdcf38
SHA256

ae5f01695d046a56eb08b76363f51320921fd6ac021ec057d90785d976832c34
SHA512

9f0d32cd2b0f8f51deabf0e79d60cb8068ab9075d84b4b08d184e9266b6d55b779dfc8e8d49988b3efb6f14b08950f922b64342287fe736acf77b32aa7507f91
SSDEEP

768:NYN31nEZlOxsDSBppfF3GVk4v4ccO/fD3lzo1r8IYOz27s:e0IdBDtGVmEflMoIYOiQ

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

C2

http://185.246.220.208:5358

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 27 IoCs

flow	pid	Process
9	1548	wscript.exe
10	2004	wscript.exe
11	1684	wscript.exe
12	1684	wscript.exe
13	1684	wscript.exe
17	1684	wscript.exe
19	1548	wscript.exe
20	1684	wscript.exe
22	2004	wscript.exe
24	1684	wscript.exe
26	1684	wscript.exe
29	1684	wscript.exe
31	1548	wscript.exe
33	2004	wscript.exe
34	1684	wscript.exe
36	1684	wscript.exe
37	1684	wscript.exe
41	2004	wscript.exe
43	1548	wscript.exe
45	1684	wscript.exe
47	1684	wscript.exe
50	1684	wscript.exe
51	2004	wscript.exe
54	1548	wscript.exe
55	1684	wscript.exe
57	1684	wscript.exe
58	1684	wscript.exe

Drops startup file 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dlaOuRctgb.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dlaOuRctgb.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dlaOuRctgb.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 17 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	24	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	36	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	47	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	57	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	13	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	26	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	37	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	45	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	58	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	12	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	29	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	34	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	50	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	11	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	17	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	20	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript
HTTP User-Agent header	55	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 2/12/2022\|JavaScript

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2004	2012	wscript.exe	27
PID 2012 wrote to memory of 2004	2012	wscript.exe	27
PID 2012 wrote to memory of 2004	2012	wscript.exe	27
PID 2012 wrote to memory of 1684	2012	wscript.exe	28
PID 2012 wrote to memory of 1684	2012	wscript.exe	28
PID 2012 wrote to memory of 1684	2012	wscript.exe	28
PID 1684 wrote to memory of 1548	1684	wscript.exe	30
PID 1684 wrote to memory of 1548	1684	wscript.exe	30
PID 1684 wrote to memory of 1548	1684	wscript.exe	30

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quotation Request.js"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:2004
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Quotation Request.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:1548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js

Filesize
42KB

MD5
c345961a64e6bf1dd83dea9418c2323a

SHA1
b2edb5c1c41415a1b1f50a809c1b528008bdcf38

SHA256
ae5f01695d046a56eb08b76363f51320921fd6ac021ec057d90785d976832c34

SHA512
9f0d32cd2b0f8f51deabf0e79d60cb8068ab9075d84b4b08d184e9266b6d55b779dfc8e8d49988b3efb6f14b08950f922b64342287fe736acf77b32aa7507f91

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dlaOuRctgb.js

Filesize
7KB

MD5
6ec157e9bc6512caa18d2c4d438bceff

SHA1
c16435aa60bd5ffda8546a18233c3f6c521a9f1e

SHA256
73ece740572017a0a3ed9e88f1a8169796690606ed5284db979fd975c774bf44

SHA512
ccf524745228ae4dda399a7d3e3f78f285233d88ca7ae28bdd306b820f7a2799c18387f75cf0a3a995d52ea8dfc529d7e940ce8e54a41ab51e22fc97644bfd44

Download Submit
C:\Users\Admin\AppData\Roaming\Quotation Request.js

Filesize
42KB

MD5
c345961a64e6bf1dd83dea9418c2323a

SHA1
b2edb5c1c41415a1b1f50a809c1b528008bdcf38

SHA256
ae5f01695d046a56eb08b76363f51320921fd6ac021ec057d90785d976832c34

SHA512
9f0d32cd2b0f8f51deabf0e79d60cb8068ab9075d84b4b08d184e9266b6d55b779dfc8e8d49988b3efb6f14b08950f922b64342287fe736acf77b32aa7507f91

Download Submit
C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js

Filesize
7KB

MD5
6ec157e9bc6512caa18d2c4d438bceff

SHA1
c16435aa60bd5ffda8546a18233c3f6c521a9f1e

SHA256
73ece740572017a0a3ed9e88f1a8169796690606ed5284db979fd975c774bf44

SHA512
ccf524745228ae4dda399a7d3e3f78f285233d88ca7ae28bdd306b820f7a2799c18387f75cf0a3a995d52ea8dfc529d7e940ce8e54a41ab51e22fc97644bfd44

Download Submit
C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js

Filesize
7KB

MD5
6ec157e9bc6512caa18d2c4d438bceff

SHA1
c16435aa60bd5ffda8546a18233c3f6c521a9f1e

SHA256
73ece740572017a0a3ed9e88f1a8169796690606ed5284db979fd975c774bf44

SHA512
ccf524745228ae4dda399a7d3e3f78f285233d88ca7ae28bdd306b820f7a2799c18387f75cf0a3a995d52ea8dfc529d7e940ce8e54a41ab51e22fc97644bfd44

Download Submit
memory/2012-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing