vjw0rm | aeedca1560f20e90dc61392f917ec34ee6248dcde0107f986f18e3f5e65b3698

General

Target

Payment Invoice #81043714.js
Size

50KB
MD5

420e4b61bb014da713db2add36773df6
SHA1

725cf6c6a5ba19491503d418c09afbc2630b8121
SHA256

aeedca1560f20e90dc61392f917ec34ee6248dcde0107f986f18e3f5e65b3698
SHA512

8c6ee0e8825e6c9038baaf6594d16f4e1af8a962ac50689c5a44f6d5469270c821b412613d937dd87f757fcac364264cbf91a2e3076878e6f4e1f6b87f96641c
SSDEEP

1536:0ApR1ygtHzqLH5Nk9hSrHAbsHrTzxABUizbd2M0SaacD:02HJHWLH5S9qHEsHvSCa0pacD

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

C2

http://185.246.220.208:5358

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 24 IoCs

flow	pid	Process
9	836	wscript.exe
10	1544	wscript.exe
11	524	wscript.exe
12	524	wscript.exe
15	524	wscript.exe
17	836	wscript.exe
20	1544	wscript.exe
21	524	wscript.exe
23	524	wscript.exe
26	524	wscript.exe
28	836	wscript.exe
31	1544	wscript.exe
32	524	wscript.exe
33	524	wscript.exe
38	524	wscript.exe
39	836	wscript.exe
41	1544	wscript.exe
44	524	wscript.exe
45	524	wscript.exe
48	524	wscript.exe
49	1544	wscript.exe
52	836	wscript.exe
54	524	wscript.exe
55	524	wscript.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LxhmpeLlfJ.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LxhmpeLlfJ.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment Invoice #81043714.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LxhmpeLlfJ.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment Invoice #81043714.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Payment Invoice #81043714 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Payment Invoice #81043714.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Payment Invoice #81043714 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Payment Invoice #81043714.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Payment Invoice #81043714 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Payment Invoice #81043714.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Payment Invoice #81043714 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Payment Invoice #81043714.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 14 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	21	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	32	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	11	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	15	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	12	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	38	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	44	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	45	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	48	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	54	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	23	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	26	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	33	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript
HTTP User-Agent header	55	WSHRAT\|94A7BB46\|RYNKSFQE\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 5/12/2022\|JavaScript

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 836	1128	wscript.exe	27
PID 1128 wrote to memory of 836	1128	wscript.exe	27
PID 1128 wrote to memory of 836	1128	wscript.exe	27
PID 1128 wrote to memory of 524	1128	wscript.exe	28
PID 1128 wrote to memory of 524	1128	wscript.exe	28
PID 1128 wrote to memory of 524	1128	wscript.exe	28
PID 524 wrote to memory of 1544	524	wscript.exe	30
PID 524 wrote to memory of 1544	524	wscript.exe	30
PID 524 wrote to memory of 1544	524	wscript.exe	30

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Payment Invoice #81043714.js"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\LxhmpeLlfJ.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:836
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Payment Invoice #81043714.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\LxhmpeLlfJ.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\LxhmpeLlfJ.js

Filesize
10KB

MD5
dcd3971981a8d59077182f13d6f43f6f

SHA1
30119d3a59eb076e97a8001d8fe1f15ff1c1721f

SHA256
817f6a35953f7af8b3c4e17e026dc765f06dde5b094f0573edd282284e7db332

SHA512
cfd5edd4c25b182a03244eb6f94b4676a8abe556ef8b593a93ab369db97f7803081be40c2d02d8aec6da6bb9994e8742ce3f49d76ead34647c5a4ffe1c3e5674

Download Submit
C:\Users\Admin\AppData\Roaming\LxhmpeLlfJ.js

Filesize
10KB

MD5
dcd3971981a8d59077182f13d6f43f6f

SHA1
30119d3a59eb076e97a8001d8fe1f15ff1c1721f

SHA256
817f6a35953f7af8b3c4e17e026dc765f06dde5b094f0573edd282284e7db332

SHA512
cfd5edd4c25b182a03244eb6f94b4676a8abe556ef8b593a93ab369db97f7803081be40c2d02d8aec6da6bb9994e8742ce3f49d76ead34647c5a4ffe1c3e5674

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LxhmpeLlfJ.js

Filesize
10KB

MD5
dcd3971981a8d59077182f13d6f43f6f

SHA1
30119d3a59eb076e97a8001d8fe1f15ff1c1721f

SHA256
817f6a35953f7af8b3c4e17e026dc765f06dde5b094f0573edd282284e7db332

SHA512
cfd5edd4c25b182a03244eb6f94b4676a8abe556ef8b593a93ab369db97f7803081be40c2d02d8aec6da6bb9994e8742ce3f49d76ead34647c5a4ffe1c3e5674

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payment Invoice #81043714.js

Filesize
50KB

MD5
420e4b61bb014da713db2add36773df6

SHA1
725cf6c6a5ba19491503d418c09afbc2630b8121

SHA256
aeedca1560f20e90dc61392f917ec34ee6248dcde0107f986f18e3f5e65b3698

SHA512
8c6ee0e8825e6c9038baaf6594d16f4e1af8a962ac50689c5a44f6d5469270c821b412613d937dd87f757fcac364264cbf91a2e3076878e6f4e1f6b87f96641c

Download Submit
C:\Users\Admin\AppData\Roaming\Payment Invoice #81043714.js

Filesize
50KB

MD5
420e4b61bb014da713db2add36773df6

SHA1
725cf6c6a5ba19491503d418c09afbc2630b8121

SHA256
aeedca1560f20e90dc61392f917ec34ee6248dcde0107f986f18e3f5e65b3698

SHA512
8c6ee0e8825e6c9038baaf6594d16f4e1af8a962ac50689c5a44f6d5469270c821b412613d937dd87f757fcac364264cbf91a2e3076878e6f4e1f6b87f96641c

Download Submit
memory/1128-54-0x000007FEFC591000-0x000007FEFC593000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing