vjw0rm | 453b93a211b664c8be6ad43c584a9c4e3781ea9e51c3d9d598b4cd9719fcb7c6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2023 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e98c04e777e77b1498f4b3447b6221d.js
Size

3.5MB
MD5

9e98c04e777e77b1498f4b3447b6221d
SHA1

00a23c268459816d8fe5d46bda86a36f06e0c374
SHA256

39e57f5e8da66eb93df1bf017348f3cc3007e3acfe568a846d420ea76fdd43b3
SHA512

e5cb2b6f79474e70cb807b4a26af782a328038e52d2e28e6640269026c91c97ff40d3b98e6a156410339b4e53b538d256d0b554013bb78ce88ec1dc010d889d5
SSDEEP

24576:mOEJFi25vJDMJ7Ukw2QaaRn1xWl1TUPZAO2OR1X1S8DlF5y0d5tQtiTWyXE7D/Ag:6ZMf

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

http://smile4u.webredirect.org:4242

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 40 IoCs

flow	pid	Process
26	1776	wscript.exe
29	1508	wscript.exe
31	2144	wscript.exe
37	2144	wscript.exe
46	2144	wscript.exe
47	2144	wscript.exe
49	2144	wscript.exe
53	2144	wscript.exe
56	1776	wscript.exe
58	1508	wscript.exe
59	2144	wscript.exe
61	2144	wscript.exe
62	2144	wscript.exe
63	2144	wscript.exe
67	2144	wscript.exe
68	1776	wscript.exe
69	1508	wscript.exe
72	2144	wscript.exe
75	2144	wscript.exe
80	2144	wscript.exe
81	2144	wscript.exe
82	2144	wscript.exe
83	1776	wscript.exe
84	1508	wscript.exe
85	2144	wscript.exe
86	2144	wscript.exe
87	2144	wscript.exe
92	2144	wscript.exe
102	2144	wscript.exe
103	2144	wscript.exe
104	1776	wscript.exe
105	1508	wscript.exe
106	2144	wscript.exe
107	2144	wscript.exe
108	2144	wscript.exe
109	2144	wscript.exe
110	2144	wscript.exe
111	1776	wscript.exe
112	1508	wscript.exe
113	2144	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e98c04e777e77b1498f4b3447b6221d.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eTnwIXREbR.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eTnwIXREbR.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e98c04e777e77b1498f4b3447b6221d.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eTnwIXREbR.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9e98c04e777e77b1498f4b3447b6221d = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9e98c04e777e77b1498f4b3447b6221d.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9e98c04e777e77b1498f4b3447b6221d = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9e98c04e777e77b1498f4b3447b6221d.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9e98c04e777e77b1498f4b3447b6221d = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9e98c04e777e77b1498f4b3447b6221d.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9e98c04e777e77b1498f4b3447b6221d = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9e98c04e777e77b1498f4b3447b6221d.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\software\microsoft\windows\currentversion\run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 28 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	107	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	53	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	67	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	63	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	110	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	49	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	61	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	92	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	62	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	87	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	80	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	102	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	46	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	113	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	59	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	86	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	37	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	47	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	108	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	82	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	106	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	75	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	81	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	85	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	103	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	109	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	31	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript
HTTP User-Agent header	72	WSHRAT\|D0F59775\|TPAVZECK\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 25/3/2023\|JavaScript

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1776	5076	wscript.exe	85
PID 5076 wrote to memory of 1776	5076	wscript.exe	85
PID 5076 wrote to memory of 2144	5076	wscript.exe	86
PID 5076 wrote to memory of 2144	5076	wscript.exe	86
PID 2144 wrote to memory of 1508	2144	wscript.exe	87
PID 2144 wrote to memory of 1508	2144	wscript.exe	87

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\9e98c04e777e77b1498f4b3447b6221d.js
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\eTnwIXREbR.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1776
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\9e98c04e777e77b1498f4b3447b6221d.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\eTnwIXREbR.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9e98c04e777e77b1498f4b3447b6221d.js

Filesize
3.5MB

MD5
9e98c04e777e77b1498f4b3447b6221d

SHA1
00a23c268459816d8fe5d46bda86a36f06e0c374

SHA256
39e57f5e8da66eb93df1bf017348f3cc3007e3acfe568a846d420ea76fdd43b3

SHA512
e5cb2b6f79474e70cb807b4a26af782a328038e52d2e28e6640269026c91c97ff40d3b98e6a156410339b4e53b538d256d0b554013bb78ce88ec1dc010d889d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e98c04e777e77b1498f4b3447b6221d.js

Filesize
3.5MB

MD5
9e98c04e777e77b1498f4b3447b6221d

SHA1
00a23c268459816d8fe5d46bda86a36f06e0c374

SHA256
39e57f5e8da66eb93df1bf017348f3cc3007e3acfe568a846d420ea76fdd43b3

SHA512
e5cb2b6f79474e70cb807b4a26af782a328038e52d2e28e6640269026c91c97ff40d3b98e6a156410339b4e53b538d256d0b554013bb78ce88ec1dc010d889d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9e98c04e777e77b1498f4b3447b6221d.js

Filesize
3.5MB

MD5
9e98c04e777e77b1498f4b3447b6221d

SHA1
00a23c268459816d8fe5d46bda86a36f06e0c374

SHA256
39e57f5e8da66eb93df1bf017348f3cc3007e3acfe568a846d420ea76fdd43b3

SHA512
e5cb2b6f79474e70cb807b4a26af782a328038e52d2e28e6640269026c91c97ff40d3b98e6a156410339b4e53b538d256d0b554013bb78ce88ec1dc010d889d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eTnwIXREbR.js

Filesize
346KB

MD5
b43bf8252ad3a3e446126a99e944cd4e

SHA1
c1a8971c18e14c69141d4ab9bfb2832323677a0d

SHA256
3d2a10980087f97455426f3486c74aeeb705f782317819687aaa44e4c0a58dca

SHA512
e30050ce894c855249fa57874aded7059912b5f7852b693ec3b015f0bd83a9a9db342b2b942a8a0074f1a2b9a78881cc23adfc5f1a2687aeb5798312a0b47d02

Download Submit
C:\Users\Admin\AppData\Roaming\eTnwIXREbR.js

Filesize
346KB

MD5
b43bf8252ad3a3e446126a99e944cd4e

SHA1
c1a8971c18e14c69141d4ab9bfb2832323677a0d

SHA256
3d2a10980087f97455426f3486c74aeeb705f782317819687aaa44e4c0a58dca

SHA512
e30050ce894c855249fa57874aded7059912b5f7852b693ec3b015f0bd83a9a9db342b2b942a8a0074f1a2b9a78881cc23adfc5f1a2687aeb5798312a0b47d02

Download Submit
C:\Users\Admin\AppData\Roaming\eTnwIXREbR.js

Filesize
346KB

MD5
b43bf8252ad3a3e446126a99e944cd4e

SHA1
c1a8971c18e14c69141d4ab9bfb2832323677a0d

SHA256
3d2a10980087f97455426f3486c74aeeb705f782317819687aaa44e4c0a58dca

SHA512
e30050ce894c855249fa57874aded7059912b5f7852b693ec3b015f0bd83a9a9db342b2b942a8a0074f1a2b9a78881cc23adfc5f1a2687aeb5798312a0b47d02

Download Submit