vjw0rm | 453b93a211b664c8be6ad43c584a9c4e3781ea9e51c3d9d598b4cd9719fcb7c6

General

Target

9e98c04e777e77b1498f4b3447b6221d.js
Size

3.5MB
MD5

9e98c04e777e77b1498f4b3447b6221d
SHA1

00a23c268459816d8fe5d46bda86a36f06e0c374
SHA256

39e57f5e8da66eb93df1bf017348f3cc3007e3acfe568a846d420ea76fdd43b3
SHA512

e5cb2b6f79474e70cb807b4a26af782a328038e52d2e28e6640269026c91c97ff40d3b98e6a156410339b4e53b538d256d0b554013bb78ce88ec1dc010d889d5
SSDEEP

24576:mOEJFi25vJDMJ7Ukw2QaaRn1xWl1TUPZAO2OR1X1S8DlF5y0d5tQtiTWyXE7D/Ag:6ZMf

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

C2

http://smile4u.webredirect.org:4242

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 35 IoCs

flow	pid	Process
10	1564	wscript.exe
11	1780	wscript.exe
12	612	wscript.exe
14	612	wscript.exe
15	612	wscript.exe
18	612	wscript.exe
23	612	wscript.exe
24	612	wscript.exe
27	1564	wscript.exe
29	1780	wscript.exe
30	612	wscript.exe
33	612	wscript.exe
35	612	wscript.exe
38	612	wscript.exe
41	612	wscript.exe
42	1564	wscript.exe
44	1780	wscript.exe
46	612	wscript.exe
49	612	wscript.exe
51	612	wscript.exe
54	612	wscript.exe
58	612	wscript.exe
61	1780	wscript.exe
62	1564	wscript.exe
64	612	wscript.exe
66	612	wscript.exe
68	612	wscript.exe
72	612	wscript.exe
74	612	wscript.exe
77	1780	wscript.exe
78	1564	wscript.exe
79	612	wscript.exe
81	612	wscript.exe
83	612	wscript.exe
86	612	wscript.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e98c04e777e77b1498f4b3447b6221d.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eTnwIXREbR.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eTnwIXREbR.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e98c04e777e77b1498f4b3447b6221d.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eTnwIXREbR.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\9e98c04e777e77b1498f4b3447b6221d = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9e98c04e777e77b1498f4b3447b6221d.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9e98c04e777e77b1498f4b3447b6221d = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9e98c04e777e77b1498f4b3447b6221d.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\9e98c04e777e77b1498f4b3447b6221d = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9e98c04e777e77b1498f4b3447b6221d.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9e98c04e777e77b1498f4b3447b6221d = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9e98c04e777e77b1498f4b3447b6221d.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 25 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	12	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	18	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	46	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	49	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	51	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	68	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	83	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	30	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	41	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	66	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	72	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	79	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	15	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	33	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	38	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	14	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	23	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	24	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	35	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	54	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	58	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	64	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	74	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	81	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	86	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 25/3/2023\|JavaScript

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1780	824	wscript.exe	28
PID 824 wrote to memory of 1780	824	wscript.exe	28
PID 824 wrote to memory of 1780	824	wscript.exe	28
PID 824 wrote to memory of 612	824	wscript.exe	29
PID 824 wrote to memory of 612	824	wscript.exe	29
PID 824 wrote to memory of 612	824	wscript.exe	29
PID 612 wrote to memory of 1564	612	wscript.exe	31
PID 612 wrote to memory of 1564	612	wscript.exe	31
PID 612 wrote to memory of 1564	612	wscript.exe	31

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\9e98c04e777e77b1498f4b3447b6221d.js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\eTnwIXREbR.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1780
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\9e98c04e777e77b1498f4b3447b6221d.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\eTnwIXREbR.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9e98c04e777e77b1498f4b3447b6221d.js

Filesize
3.5MB

MD5
9e98c04e777e77b1498f4b3447b6221d

SHA1
00a23c268459816d8fe5d46bda86a36f06e0c374

SHA256
39e57f5e8da66eb93df1bf017348f3cc3007e3acfe568a846d420ea76fdd43b3

SHA512
e5cb2b6f79474e70cb807b4a26af782a328038e52d2e28e6640269026c91c97ff40d3b98e6a156410339b4e53b538d256d0b554013bb78ce88ec1dc010d889d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e98c04e777e77b1498f4b3447b6221d.js

Filesize
3.5MB

MD5
9e98c04e777e77b1498f4b3447b6221d

SHA1
00a23c268459816d8fe5d46bda86a36f06e0c374

SHA256
39e57f5e8da66eb93df1bf017348f3cc3007e3acfe568a846d420ea76fdd43b3

SHA512
e5cb2b6f79474e70cb807b4a26af782a328038e52d2e28e6640269026c91c97ff40d3b98e6a156410339b4e53b538d256d0b554013bb78ce88ec1dc010d889d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e98c04e777e77b1498f4b3447b6221d.js

Filesize
3.5MB

MD5
9e98c04e777e77b1498f4b3447b6221d

SHA1
00a23c268459816d8fe5d46bda86a36f06e0c374

SHA256
39e57f5e8da66eb93df1bf017348f3cc3007e3acfe568a846d420ea76fdd43b3

SHA512
e5cb2b6f79474e70cb807b4a26af782a328038e52d2e28e6640269026c91c97ff40d3b98e6a156410339b4e53b538d256d0b554013bb78ce88ec1dc010d889d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eTnwIXREbR.js

Filesize
346KB

MD5
b43bf8252ad3a3e446126a99e944cd4e

SHA1
c1a8971c18e14c69141d4ab9bfb2832323677a0d

SHA256
3d2a10980087f97455426f3486c74aeeb705f782317819687aaa44e4c0a58dca

SHA512
e30050ce894c855249fa57874aded7059912b5f7852b693ec3b015f0bd83a9a9db342b2b942a8a0074f1a2b9a78881cc23adfc5f1a2687aeb5798312a0b47d02

Download Submit
C:\Users\Admin\AppData\Roaming\eTnwIXREbR.js

Filesize
346KB

MD5
b43bf8252ad3a3e446126a99e944cd4e

SHA1
c1a8971c18e14c69141d4ab9bfb2832323677a0d

SHA256
3d2a10980087f97455426f3486c74aeeb705f782317819687aaa44e4c0a58dca

SHA512
e30050ce894c855249fa57874aded7059912b5f7852b693ec3b015f0bd83a9a9db342b2b942a8a0074f1a2b9a78881cc23adfc5f1a2687aeb5798312a0b47d02

Download Submit
C:\Users\Admin\AppData\Roaming\eTnwIXREbR.js

Filesize
346KB

MD5
b43bf8252ad3a3e446126a99e944cd4e

SHA1
c1a8971c18e14c69141d4ab9bfb2832323677a0d

SHA256
3d2a10980087f97455426f3486c74aeeb705f782317819687aaa44e4c0a58dca

SHA512
e30050ce894c855249fa57874aded7059912b5f7852b693ec3b015f0bd83a9a9db342b2b942a8a0074f1a2b9a78881cc23adfc5f1a2687aeb5798312a0b47d02

Download Submit

Analysis

Sharing