vjw0rm | 3f3ee13d1a86d8f63c3c730556cfcff2a1f8d22980fdc001b5240ce7315dcd23

Analysis

max time kernel
298s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2023, 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ShippingDetails_UPS.js
Size

4.6MB
MD5

e8150ba03200183abce718f6b028b2c3
SHA1

606491a54f6dc244fc533317a0f936b818de9a4c
SHA256

3f3ee13d1a86d8f63c3c730556cfcff2a1f8d22980fdc001b5240ce7315dcd23
SHA512

4aa7fd5b696933155143f66a54785c48ff368bb6fbf7f5afcc24ababd2436c31b0d847f32b3d66888867f179a34dd9284a9c9a8f54f3f96ea23601804bafacb5
SSDEEP

24576:p5K1gGMDzG6PbjQ46Te9iEQokfhrC/SwzkfHGi9xM7LHyG9XqUrQdAtzkTGCJTrK:G3Fmv

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

http://139.177.146.165:4848

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 64 IoCs

flow	pid	Process
20	1920	wscript.exe
23	2940	wscript.exe
24	1016	wscript.exe
27	2940	wscript.exe
28	1920	wscript.exe
31	1016	wscript.exe
35	2940	wscript.exe
39	2940	wscript.exe
40	1920	wscript.exe
41	1016	wscript.exe
42	2940	wscript.exe
45	1920	wscript.exe
46	2940	wscript.exe
47	1016	wscript.exe
49	2940	wscript.exe
52	1920	wscript.exe
53	2940	wscript.exe
54	1016	wscript.exe
58	2940	wscript.exe
60	1920	wscript.exe
61	1016	wscript.exe
62	2940	wscript.exe
63	2940	wscript.exe
65	1920	wscript.exe
66	1016	wscript.exe
67	2940	wscript.exe
68	2940	wscript.exe
69	1920	wscript.exe
71	1016	wscript.exe
72	2940	wscript.exe
73	1920	wscript.exe
74	2940	wscript.exe
75	1016	wscript.exe
76	2940	wscript.exe
77	1920	wscript.exe
78	1016	wscript.exe
79	2940	wscript.exe
81	2940	wscript.exe
82	1920	wscript.exe
83	1016	wscript.exe
84	2940	wscript.exe
85	2940	wscript.exe
86	1920	wscript.exe
87	1016	wscript.exe
88	2940	wscript.exe
90	1920	wscript.exe
91	2940	wscript.exe
92	1016	wscript.exe
93	2940	wscript.exe
94	1920	wscript.exe
95	1016	wscript.exe
96	2940	wscript.exe
97	2940	wscript.exe
99	1920	wscript.exe
100	1016	wscript.exe
101	2940	wscript.exe
102	2940	wscript.exe
103	1920	wscript.exe
104	1016	wscript.exe
105	2940	wscript.exe
106	1920	wscript.exe
107	2940	wscript.exe
109	1016	wscript.exe
110	2940	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShippingDetails_UPS.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VQlpXNzQJz.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VQlpXNzQJz.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShippingDetails_UPS.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VQlpXNzQJz.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShippingDetails_UPS = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ShippingDetails_UPS.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShippingDetails_UPS = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ShippingDetails_UPS.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShippingDetails_UPS = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ShippingDetails_UPS.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShippingDetails_UPS = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\ShippingDetails_UPS.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\software\microsoft\windows\currentversion\run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 56 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	81	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	91	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	46	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	114	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	23	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	137	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	148	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	179	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	126	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	150	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	35	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	67	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	84	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	102	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	110	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	171	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	39	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	124	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	167	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	85	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	88	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	63	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	72	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	154	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	173	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	76	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	74	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	93	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	152	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	79	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	164	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	182	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	62	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	96	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	101	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	107	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	143	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	42	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	53	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	122	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	97	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	142	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	146	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	169	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	178	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	27	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	58	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	105	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	119	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	139	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	175	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	49	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	68	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	112	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	117	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript
HTTP User-Agent header	157	WSHRAT\|10B1D74F\|TLGENAJY\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 4/6/2023\|JavaScript

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1920	628	wscript.exe	84
PID 628 wrote to memory of 1920	628	wscript.exe	84
PID 628 wrote to memory of 2940	628	wscript.exe	85
PID 628 wrote to memory of 2940	628	wscript.exe	85
PID 2940 wrote to memory of 1016	2940	wscript.exe	86
PID 2940 wrote to memory of 1016	2940	wscript.exe	86

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ShippingDetails_UPS.js
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\VQlpXNzQJz.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1920
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ShippingDetails_UPS.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\VQlpXNzQJz.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShippingDetails_UPS.js

Filesize
4.6MB

MD5
ee6689f7a8620f43de1acfcb7ffecd22

SHA1
d9ad3ac8a810a79292a2242edee73833d1bc74f4

SHA256
6c6fc03f82812e899525a67893807a496482090a5e98225297df77cb2f6c65ee

SHA512
2e80e52a1ebd88d8ee78494267eecfaa93896fecbafcc74edb3f888bf53c58fbaeee3c8c9c59fd39899cb9ed64d463e6a6d11edfe9c21d8702f6a0d4a80902a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShippingDetails_UPS.js

Filesize
4.6MB

MD5
e8150ba03200183abce718f6b028b2c3

SHA1
606491a54f6dc244fc533317a0f936b818de9a4c

SHA256
3f3ee13d1a86d8f63c3c730556cfcff2a1f8d22980fdc001b5240ce7315dcd23

SHA512
4aa7fd5b696933155143f66a54785c48ff368bb6fbf7f5afcc24ababd2436c31b0d847f32b3d66888867f179a34dd9284a9c9a8f54f3f96ea23601804bafacb5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VQlpXNzQJz.js

Filesize
346KB

MD5
3ed07b2cfc14457c448129ac338d1a9b

SHA1
e07cd37475c0a9e2c53d4f7df317c8b4be70855e

SHA256
ed505690251f92f79fb3341968a3283e69bcd4ffe08539593b1601fac515c36b

SHA512
db34f63ad7cd4580c200040f1ced68ef7477cf61e44304932a2989cda520a56e90bf51d27bcd8474f14600a92f25664befa9a64caf26c009d5ecb6a610b78fa5

Download Submit
C:\Users\Admin\AppData\Roaming\ShippingDetails_UPS.js

Filesize
4.6MB

MD5
e8150ba03200183abce718f6b028b2c3

SHA1
606491a54f6dc244fc533317a0f936b818de9a4c

SHA256
3f3ee13d1a86d8f63c3c730556cfcff2a1f8d22980fdc001b5240ce7315dcd23

SHA512
4aa7fd5b696933155143f66a54785c48ff368bb6fbf7f5afcc24ababd2436c31b0d847f32b3d66888867f179a34dd9284a9c9a8f54f3f96ea23601804bafacb5

Download Submit
C:\Users\Admin\AppData\Roaming\VQlpXNzQJz.js

Filesize
346KB

MD5
3ed07b2cfc14457c448129ac338d1a9b

SHA1
e07cd37475c0a9e2c53d4f7df317c8b4be70855e

SHA256
ed505690251f92f79fb3341968a3283e69bcd4ffe08539593b1601fac515c36b

SHA512
db34f63ad7cd4580c200040f1ced68ef7477cf61e44304932a2989cda520a56e90bf51d27bcd8474f14600a92f25664befa9a64caf26c009d5ecb6a610b78fa5

Download Submit
C:\Users\Admin\AppData\Roaming\VQlpXNzQJz.js

Filesize
346KB

MD5
3ed07b2cfc14457c448129ac338d1a9b

SHA1
e07cd37475c0a9e2c53d4f7df317c8b4be70855e

SHA256
ed505690251f92f79fb3341968a3283e69bcd4ffe08539593b1601fac515c36b

SHA512
db34f63ad7cd4580c200040f1ced68ef7477cf61e44304932a2989cda520a56e90bf51d27bcd8474f14600a92f25664befa9a64caf26c009d5ecb6a610b78fa5

Download Submit