vjw0rm | abb83301f8ec06fd4bb89cbe4efd509acaef3b24f87e995b6f631943b9b1454b

General

Target

Quotation Request.js
Size

42KB
MD5

c345961a64e6bf1dd83dea9418c2323a
SHA1

b2edb5c1c41415a1b1f50a809c1b528008bdcf38
SHA256

ae5f01695d046a56eb08b76363f51320921fd6ac021ec057d90785d976832c34
SHA512

9f0d32cd2b0f8f51deabf0e79d60cb8068ab9075d84b4b08d184e9266b6d55b779dfc8e8d49988b3efb6f14b08950f922b64342287fe736acf77b32aa7507f91
SSDEEP

768:NYN31nEZlOxsDSBppfF3GVk4v4ccO/fD3lzo1r8IYOz27s:e0IdBDtGVmEflMoIYOiQ

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
63	1092	wscript.exe
65	4772	wscript.exe
66	424	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dlaOuRctgb.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dlaOuRctgb.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dlaOuRctgb.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Quotation Request = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Quotation Request.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	63	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 2/12/2022\|JavaScript

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 424	676	wscript.exe	79
PID 676 wrote to memory of 424	676	wscript.exe	79
PID 676 wrote to memory of 1092	676	wscript.exe	80
PID 676 wrote to memory of 1092	676	wscript.exe	80
PID 1092 wrote to memory of 4772	1092	wscript.exe	82
PID 1092 wrote to memory of 4772	1092	wscript.exe	82

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quotation Request.js"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:676
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:424
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Quotation Request.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:4772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Quotation Request.js

Filesize
42KB

MD5
c345961a64e6bf1dd83dea9418c2323a

SHA1
b2edb5c1c41415a1b1f50a809c1b528008bdcf38

SHA256
ae5f01695d046a56eb08b76363f51320921fd6ac021ec057d90785d976832c34

SHA512
9f0d32cd2b0f8f51deabf0e79d60cb8068ab9075d84b4b08d184e9266b6d55b779dfc8e8d49988b3efb6f14b08950f922b64342287fe736acf77b32aa7507f91

Download Submit
C:\Users\Admin\AppData\Roaming\Quotation Request.js

Filesize
42KB

MD5
c345961a64e6bf1dd83dea9418c2323a

SHA1
b2edb5c1c41415a1b1f50a809c1b528008bdcf38

SHA256
ae5f01695d046a56eb08b76363f51320921fd6ac021ec057d90785d976832c34

SHA512
9f0d32cd2b0f8f51deabf0e79d60cb8068ab9075d84b4b08d184e9266b6d55b779dfc8e8d49988b3efb6f14b08950f922b64342287fe736acf77b32aa7507f91

Download Submit
C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js

Filesize
7KB

MD5
6ec157e9bc6512caa18d2c4d438bceff

SHA1
c16435aa60bd5ffda8546a18233c3f6c521a9f1e

SHA256
73ece740572017a0a3ed9e88f1a8169796690606ed5284db979fd975c774bf44

SHA512
ccf524745228ae4dda399a7d3e3f78f285233d88ca7ae28bdd306b820f7a2799c18387f75cf0a3a995d52ea8dfc529d7e940ce8e54a41ab51e22fc97644bfd44

Download Submit
C:\Users\Admin\AppData\Roaming\dlaOuRctgb.js

Filesize
7KB

MD5
6ec157e9bc6512caa18d2c4d438bceff

SHA1
c16435aa60bd5ffda8546a18233c3f6c521a9f1e

SHA256
73ece740572017a0a3ed9e88f1a8169796690606ed5284db979fd975c774bf44

SHA512
ccf524745228ae4dda399a7d3e3f78f285233d88ca7ae28bdd306b820f7a2799c18387f75cf0a3a995d52ea8dfc529d7e940ce8e54a41ab51e22fc97644bfd44

Download Submit

Analysis

Sharing