vjw0rm | 7c0df5e5dc598888c62cb7ebfb76b940e310b45f7c78a4a0797aabd4b6e1f1b2

General

Target

Fully Executed Contract.js
Size

984KB
MD5

6896610816747b15420b9c1b481283ec
SHA1

2a942e057e0d1427cca9827a2e268d2aca207e16
SHA256

7c0df5e5dc598888c62cb7ebfb76b940e310b45f7c78a4a0797aabd4b6e1f1b2
SHA512

291f0314936b742383a20b4a5bb6abf6f39bc4d97e09346e275ef2de9d9c97c9788c7f0d11e6bf41cbfce7645df89586b98ed94200bd2d7df769d605275d98c8
SSDEEP

6144:eQfPBx5q0sQ1o7rsbHC01mDBpNW2mTMSbpuV8exLbSXlZB7AM:eQ3B7qgpKLbE

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

C2

http://auto.stevenpartners.com:23015

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 57 IoCs

Processes:

wscript.exewscript.exewscript.exe

flow	pid	process
8	4944	wscript.exe
9	960	wscript.exe
10	3148	wscript.exe
23	4944	wscript.exe
24	3148	wscript.exe
25	960	wscript.exe
27	4944	wscript.exe
35	3148	wscript.exe
36	960	wscript.exe
37	4944	wscript.exe
38	4944	wscript.exe
48	960	wscript.exe
49	3148	wscript.exe
51	4944	wscript.exe
52	4944	wscript.exe
53	960	wscript.exe
54	3148	wscript.exe
55	4944	wscript.exe
56	960	wscript.exe
57	3148	wscript.exe
58	4944	wscript.exe
61	4944	wscript.exe
62	3148	wscript.exe
63	960	wscript.exe
67	4944	wscript.exe
68	3148	wscript.exe
69	960	wscript.exe
70	4944	wscript.exe
71	4944	wscript.exe
72	3148	wscript.exe
73	960	wscript.exe
74	4944	wscript.exe
75	960	wscript.exe
76	3148	wscript.exe
77	4944	wscript.exe
79	4944	wscript.exe
80	3148	wscript.exe
81	960	wscript.exe
82	4944	wscript.exe
83	3148	wscript.exe
84	960	wscript.exe
85	4944	wscript.exe
86	4944	wscript.exe
87	3148	wscript.exe
88	960	wscript.exe
89	4944	wscript.exe
90	4944	wscript.exe
91	960	wscript.exe
92	3148	wscript.exe
93	4944	wscript.exe
94	3148	wscript.exe
95	960	wscript.exe
96	4944	wscript.exe
97	4944	wscript.exe
98	3148	wscript.exe
99	960	wscript.exe
100	4944	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

Processes:

wscript.exewscript.exewscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fully Executed Contract.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fully Executed Contract.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vruJgaVwTF.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vruJgaVwTF.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vruJgaVwTF.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fully Executed Contract = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Fully Executed Contract.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fully Executed Contract = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Fully Executed Contract.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fully Executed Contract = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Fully Executed Contract.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fully Executed Contract = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Fully Executed Contract.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 25 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	8	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	85	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	89	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	93	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	67	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	77	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	96	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	23	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	27	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	52	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	61	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	82	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	86	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	37	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	55	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	74	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	79	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	71	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	90	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	97	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	100	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	38	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	51	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	58	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript
HTTP User-Agent header	70	WSHRAT\|2C4BFA22\|XZIOFAVD\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/1/2023\|JavaScript

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exewscript.exe

description	pid	process	target process
PID 4260 wrote to memory of 3148	4260	wscript.exe	wscript.exe
PID 4260 wrote to memory of 3148	4260	wscript.exe	wscript.exe
PID 4260 wrote to memory of 4944	4260	wscript.exe	wscript.exe
PID 4260 wrote to memory of 4944	4260	wscript.exe	wscript.exe
PID 4944 wrote to memory of 960	4944	wscript.exe	wscript.exe
PID 4944 wrote to memory of 960	4944	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Fully Executed Contract.js"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4260

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\vruJgaVwTF.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
PID:3148

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Fully Executed Contract.js"
2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4944

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\vruJgaVwTF.js"
3⤵
- Blocklisted process makes network request
- Drops startup file
PID:960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Fully Executed Contract.js
Filesize
984KB

MD5
6896610816747b15420b9c1b481283ec

SHA1
2a942e057e0d1427cca9827a2e268d2aca207e16

SHA256
7c0df5e5dc598888c62cb7ebfb76b940e310b45f7c78a4a0797aabd4b6e1f1b2

SHA512
291f0314936b742383a20b4a5bb6abf6f39bc4d97e09346e275ef2de9d9c97c9788c7f0d11e6bf41cbfce7645df89586b98ed94200bd2d7df769d605275d98c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fully Executed Contract.js
Filesize
984KB

MD5
6896610816747b15420b9c1b481283ec

SHA1
2a942e057e0d1427cca9827a2e268d2aca207e16

SHA256
7c0df5e5dc598888c62cb7ebfb76b940e310b45f7c78a4a0797aabd4b6e1f1b2

SHA512
291f0314936b742383a20b4a5bb6abf6f39bc4d97e09346e275ef2de9d9c97c9788c7f0d11e6bf41cbfce7645df89586b98ed94200bd2d7df769d605275d98c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vruJgaVwTF.js
Filesize
346KB

MD5
02413cd5481c1f9eb58e5bdd5cdbf1a3

SHA1
024dc9be1421b29bc99bd39ef63c554a01c5caeb

SHA256
a681d7961a9381a8bedbd00fab5bb84128ab3a2990848aeab4c896952e79a8dc

SHA512
f4f1bebe841c38f6969ba355022af6e9c60621ddeddc0ae6d68ad559bd684c1c93680b8314637a8b6a8c299378ce254863b674d9000d191238ecdca538773011

Download Submit
C:\Users\Admin\AppData\Roaming\vruJgaVwTF.js
Filesize
346KB

MD5
02413cd5481c1f9eb58e5bdd5cdbf1a3

SHA1
024dc9be1421b29bc99bd39ef63c554a01c5caeb

SHA256
a681d7961a9381a8bedbd00fab5bb84128ab3a2990848aeab4c896952e79a8dc

SHA512
f4f1bebe841c38f6969ba355022af6e9c60621ddeddc0ae6d68ad559bd684c1c93680b8314637a8b6a8c299378ce254863b674d9000d191238ecdca538773011

Download Submit
C:\Users\Admin\AppData\Roaming\vruJgaVwTF.js
Filesize
346KB

MD5
02413cd5481c1f9eb58e5bdd5cdbf1a3

SHA1
024dc9be1421b29bc99bd39ef63c554a01c5caeb

SHA256
a681d7961a9381a8bedbd00fab5bb84128ab3a2990848aeab4c896952e79a8dc

SHA512
f4f1bebe841c38f6969ba355022af6e9c60621ddeddc0ae6d68ad559bd684c1c93680b8314637a8b6a8c299378ce254863b674d9000d191238ecdca538773011

Download Submit
memory/960-136-0x0000000000000000-mapping.dmp

Download
memory/3148-132-0x0000000000000000-mapping.dmp

Download
memory/4944-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads