vjw0rm | 069428da73eef276063d954b097054ff9a31b9265d1472fc6e067d88f5be2a87

General

Target

Solicitation#E62-359.pdf.js
Size

984KB
MD5

4e2d729e9c8329faf413b544c6e3e142
SHA1

a2e1e676ef6be73c851acbaf46b00eb8635fb875
SHA256

069428da73eef276063d954b097054ff9a31b9265d1472fc6e067d88f5be2a87
SHA512

24f0eeec9c97dbd77601c46bf2cd4ae02ebfc23f291367d1308a369df8b5f48794a11ec5720853e8507a1fa576d4b9164231ca65a4c7fa12fc7219d3ed86917f
SSDEEP

6144:eQfPBx5q0sQ1o7rsbHC01mDBpNW2mTMSbpuV8zeLoJFl7BU/J:eQ3B7qgpkLoU

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

C2

http://bona.kasowiitz.com:50125

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 62 IoCs

Processes:

wscript.exewscript.exewscript.exe

flow	pid	process
4	1996	wscript.exe
5	3964	wscript.exe
6	4844	wscript.exe
7	1996	wscript.exe
8	3964	wscript.exe
9	4844	wscript.exe
10	1996	wscript.exe
43	1996	wscript.exe
63	4844	wscript.exe
64	3964	wscript.exe
72	1996	wscript.exe
73	1996	wscript.exe
74	3964	wscript.exe
75	4844	wscript.exe
76	1996	wscript.exe
77	1996	wscript.exe
78	3964	wscript.exe
79	4844	wscript.exe
80	1996	wscript.exe
81	1996	wscript.exe
82	3964	wscript.exe
83	4844	wscript.exe
88	1996	wscript.exe
89	1996	wscript.exe
90	3964	wscript.exe
91	4844	wscript.exe
92	1996	wscript.exe
93	3964	wscript.exe
94	4844	wscript.exe
95	1996	wscript.exe
96	1996	wscript.exe
99	3964	wscript.exe
100	4844	wscript.exe
101	1996	wscript.exe
102	1996	wscript.exe
103	4844	wscript.exe
104	3964	wscript.exe
108	1996	wscript.exe
113	1996	wscript.exe
114	4844	wscript.exe
115	3964	wscript.exe
116	1996	wscript.exe
117	1996	wscript.exe
118	4844	wscript.exe
119	3964	wscript.exe
120	1996	wscript.exe
121	1996	wscript.exe
122	4844	wscript.exe
123	3964	wscript.exe
128	1996	wscript.exe
134	4844	wscript.exe
135	3964	wscript.exe
136	1996	wscript.exe
137	1996	wscript.exe
138	4844	wscript.exe
139	3964	wscript.exe
140	1996	wscript.exe
141	1996	wscript.exe
142	4844	wscript.exe
143	3964	wscript.exe
144	1996	wscript.exe
145	1996	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

Processes:

wscript.exewscript.exewscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicitation#E62-359.pdf.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicitation#E62-359.pdf.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitation#E62-359 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitation#E62-359.pdf.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{C36E2E2B-1295-4435-A8CD-32C22ABA46F3}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{72812B47-285B-4878-A6D9-EA17A2B1F15E}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Script User-Agent 30 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	4	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	10	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	43	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	96	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	108	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	117	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	73	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	76	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	137	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	141	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	144	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	136	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	140	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	7	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	81	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	95	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	120	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	128	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	121	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	145	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	72	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	77	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	80	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	88	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	89	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	92	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	101	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	102	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	113	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	116	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exewscript.exe

description	pid	process	target process
PID 1404 wrote to memory of 3964	1404	wscript.exe	wscript.exe
PID 1404 wrote to memory of 3964	1404	wscript.exe	wscript.exe
PID 1404 wrote to memory of 1996	1404	wscript.exe	wscript.exe
PID 1404 wrote to memory of 1996	1404	wscript.exe	wscript.exe
PID 1996 wrote to memory of 4844	1996	wscript.exe	wscript.exe
PID 1996 wrote to memory of 4844	1996	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Solicitation#E62-359.pdf.js
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
PID:3964

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Solicitation#E62-359.pdf.js"
2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js"
3⤵
- Blocklisted process makes network request
- Drops startup file
PID:4844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicitation#E62-359.pdf.js
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oRBIbMCDGn.js
Filesize
346KB

MD5
feb390b3400f155e4df8ddb4c2e6a121

SHA1
0c12b706f2b3b1a2db0a2693a8942e14176f56db

SHA256
ab755cf1ba6577b20e2a366910a2bfc9b20cd75c6ac0f4afacb5936e43598902

SHA512
abd24d26576fe88d013e90521d533b182cdcce0085e238d5312840747bd3d854abfc5c218c5ef4e6c8a14e35ba61ac45db8d05ec9a8f73eb7d711c901caa9b0a

Download Submit
C:\Users\Admin\AppData\Roaming\Solicitation#E62-359.pdf.js
Filesize
984KB

MD5
4e2d729e9c8329faf413b544c6e3e142

SHA1
a2e1e676ef6be73c851acbaf46b00eb8635fb875

SHA256
069428da73eef276063d954b097054ff9a31b9265d1472fc6e067d88f5be2a87

SHA512
24f0eeec9c97dbd77601c46bf2cd4ae02ebfc23f291367d1308a369df8b5f48794a11ec5720853e8507a1fa576d4b9164231ca65a4c7fa12fc7219d3ed86917f

Download Submit
C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js
Filesize
346KB

MD5
feb390b3400f155e4df8ddb4c2e6a121

SHA1
0c12b706f2b3b1a2db0a2693a8942e14176f56db

SHA256
ab755cf1ba6577b20e2a366910a2bfc9b20cd75c6ac0f4afacb5936e43598902

SHA512
abd24d26576fe88d013e90521d533b182cdcce0085e238d5312840747bd3d854abfc5c218c5ef4e6c8a14e35ba61ac45db8d05ec9a8f73eb7d711c901caa9b0a

Download Submit
C:\Users\Admin\AppData\Roaming\oRBIbMCDGn.js
Filesize
346KB

MD5
feb390b3400f155e4df8ddb4c2e6a121

SHA1
0c12b706f2b3b1a2db0a2693a8942e14176f56db

SHA256
ab755cf1ba6577b20e2a366910a2bfc9b20cd75c6ac0f4afacb5936e43598902

SHA512
abd24d26576fe88d013e90521d533b182cdcce0085e238d5312840747bd3d854abfc5c218c5ef4e6c8a14e35ba61ac45db8d05ec9a8f73eb7d711c901caa9b0a

Download Submit
memory/1996-134-0x0000000000000000-mapping.dmp

Download
memory/3964-132-0x0000000000000000-mapping.dmp

Download
memory/4844-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads