Overview

overview

10

Static

static

1

ShippingLabel.js

windows7-x64

10

ShippingLabel.js

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2023, 12:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ShippingLabel.js

  • Size

    2.7MB

  • MD5

    058446c347e32ac73a565e1a799115bd

  • SHA1

    dbbc875ed92a9875ad87165c75cc063a0bb2c440

  • SHA256

    8f9ac4d3cc786019a4a6b3b6c38f4c8c3ebe7a8b9a5b8c88ab156c427ba76648

  • SHA512

    10513b4331bb52c8fe19d6c79037a68e0bee67ec778670ab340be1f8ad3a8f3cf55c6fa4e8d7b771d2feb80ebd359abc09bf8a1baf34b5dfb21ae00c7ecfad87

  • SSDEEP

    24576:XQHhAT5XcpsjFcd5bpqXkwo1jFY7VwyHP3tfrq+lsvfzqaPd9xljl:O

Score
10/10
vjw0rmwshratpersistencetrojanworm

Malware Config

Extracted

Family

wshrat

C2

http://139.177.146.154:4242

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm
  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Blocklisted process makes network request 59 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 27 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ShippingLabel.js
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:416
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xEXWqeyWTX.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      PID:2416
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ShippingLabel.js"
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xEXWqeyWTX.js"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        PID:3572

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShippingLabel.js
    Filesize

    128KB

    MD5

    f049b3874d5c7614d5fb6f15ad4765b1

    SHA1

    7a321790de1b5af7f690e03e74ae617332a7b5b1

    SHA256

    71d5297891b098077c3b4820bc2683e5627bb13e0f80805bcafbb986f4994e05

    SHA512

    4cafdf56910429b109285b927cf101595e0f82ffa19e76b6c7579bf010847e7ba594da9cbce9d3fc00707fc9776bddd250d80a5e75039a374cee246b004381ba

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShippingLabel.js
    Filesize

    2.7MB

    MD5

    058446c347e32ac73a565e1a799115bd

    SHA1

    dbbc875ed92a9875ad87165c75cc063a0bb2c440

    SHA256

    8f9ac4d3cc786019a4a6b3b6c38f4c8c3ebe7a8b9a5b8c88ab156c427ba76648

    SHA512

    10513b4331bb52c8fe19d6c79037a68e0bee67ec778670ab340be1f8ad3a8f3cf55c6fa4e8d7b771d2feb80ebd359abc09bf8a1baf34b5dfb21ae00c7ecfad87

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xEXWqeyWTX.js
    Filesize

    346KB

    MD5

    ef0b971ae6f0713ad41a7774539bb787

    SHA1

    30e622c882a4e44b193d36c1a81d78850fe70c00

    SHA256

    62563b71eed9b8356f69bf8ba95e4664d6f936e485975d19cb04e7f456495fd3

    SHA512

    d9308bb70542e0ea6f080f5a2eafc528dd037fefe3a4b83a29721b161212572db27e20fa0d08d03dac0ae1691dd0f7c40471ab03d886158305d12ba4f48d1dc2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\ShippingLabel.js
    Filesize

    2.7MB

    MD5

    058446c347e32ac73a565e1a799115bd

    SHA1

    dbbc875ed92a9875ad87165c75cc063a0bb2c440

    SHA256

    8f9ac4d3cc786019a4a6b3b6c38f4c8c3ebe7a8b9a5b8c88ab156c427ba76648

    SHA512

    10513b4331bb52c8fe19d6c79037a68e0bee67ec778670ab340be1f8ad3a8f3cf55c6fa4e8d7b771d2feb80ebd359abc09bf8a1baf34b5dfb21ae00c7ecfad87

    Download Submit

  • C:\Users\Admin\AppData\Roaming\xEXWqeyWTX.js
    Filesize

    346KB

    MD5

    ef0b971ae6f0713ad41a7774539bb787

    SHA1

    30e622c882a4e44b193d36c1a81d78850fe70c00

    SHA256

    62563b71eed9b8356f69bf8ba95e4664d6f936e485975d19cb04e7f456495fd3

    SHA512

    d9308bb70542e0ea6f080f5a2eafc528dd037fefe3a4b83a29721b161212572db27e20fa0d08d03dac0ae1691dd0f7c40471ab03d886158305d12ba4f48d1dc2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\xEXWqeyWTX.js
    Filesize

    346KB

    MD5

    ef0b971ae6f0713ad41a7774539bb787

    SHA1

    30e622c882a4e44b193d36c1a81d78850fe70c00

    SHA256

    62563b71eed9b8356f69bf8ba95e4664d6f936e485975d19cb04e7f456495fd3

    SHA512

    d9308bb70542e0ea6f080f5a2eafc528dd037fefe3a4b83a29721b161212572db27e20fa0d08d03dac0ae1691dd0f7c40471ab03d886158305d12ba4f48d1dc2

    Download Submit