Overview

overview

10

Static

static

1

Tracking_Number.js

windows7-x64

10

Tracking_Number.js

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-07-2023 13:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Tracking_Number.js

  • Size

    2.7MB

  • MD5

    19c5045d74bd6d55551c00910f44e3cb

  • SHA1

    fa656d4789cc9f0ec6e3cd211b90eda57302c3ef

  • SHA256

    1ee08a9037a820ccadbc782796577fb8581c0003d3f53201510fded41788ddd1

  • SHA512

    516771d1bc03cfc404d99681472f2cd09c88ebc71c00c083923807154e257d4aca087d7ab9f05a74152259199223de1b2458af0e5aff0a9aea44f86c7fda0433

  • SSDEEP

    24576:QoquCbsNf3EdHLEZ8JUvJbXAGetdw8Rwzgys8Pam8Ve7Ylvi+A:AA

Score
10/10
vjw0rmwshratpersistencetrojanworm

Malware Config

Extracted

Family

wshrat

C2

http://172.93.181.132:4848

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm
  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Blocklisted process makes network request 62 IoCs
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 33 IoCs
  • Script User-Agent 30 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Tracking_Number.js
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\sCmQSwcNNH.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      PID:3380
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Tracking_Number.js"
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3940
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\sCmQSwcNNH.js"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        PID:4712
      • C:\Users\Admin\AppData\Roaming\123.exe
        "C:\Users\Admin\AppData\Roaming\123.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3908
        • C:\Users\Admin\AppData\Roaming\123.exe
          "C:\Users\Admin\AppData\Roaming\123.exe"
          4⤵
          • Executes dropped EXE
          PID:2060
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2028
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4800

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133330366073209795.txt
    Filesize

    75KB

    MD5

    22f39923e2942e5a02c3a5f91cefd45b

    SHA1

    c33909cb5ae1ad55b18b38b6aedf79c5a2216e13

    SHA256

    66457d8ac009ef25f44e676156bc058db582b2a3b431e2589435bb27477328c6

    SHA512

    17a2afe32e74150e58080055f3e67d3d4892828d9df28905a0e67227055b61eeab2a4764acf0b701bc481568fac2ccb889b326379319723fae838f8ce09e94fd

    Download Submit

  • C:\Users\Admin\AppData\Roaming\123.exe
    Filesize

    701KB

    MD5

    23d41c3c86b454bcda5886fa688d93ec

    SHA1

    ae7b5e74dbe8e0f43eda3532ae85e7e50f84a05d

    SHA256

    832b6a7cbf95224da05cea4a36b37bbde2eece2751d3a385e8a212b0fde4cbb0

    SHA512

    f45418755562d46c402fc66135e744a03dc436a5e493e44201b55e606e79b5a13bd0b8e7bcb062f1f033b15dbd47c3bc31d9b2e3336a181259d90da27f2e1434

    Download Submit

  • C:\Users\Admin\AppData\Roaming\123.exe
    Filesize

    701KB

    MD5

    23d41c3c86b454bcda5886fa688d93ec

    SHA1

    ae7b5e74dbe8e0f43eda3532ae85e7e50f84a05d

    SHA256

    832b6a7cbf95224da05cea4a36b37bbde2eece2751d3a385e8a212b0fde4cbb0

    SHA512

    f45418755562d46c402fc66135e744a03dc436a5e493e44201b55e606e79b5a13bd0b8e7bcb062f1f033b15dbd47c3bc31d9b2e3336a181259d90da27f2e1434

    Download Submit

  • C:\Users\Admin\AppData\Roaming\123.exe
    Filesize

    701KB

    MD5

    23d41c3c86b454bcda5886fa688d93ec

    SHA1

    ae7b5e74dbe8e0f43eda3532ae85e7e50f84a05d

    SHA256

    832b6a7cbf95224da05cea4a36b37bbde2eece2751d3a385e8a212b0fde4cbb0

    SHA512

    f45418755562d46c402fc66135e744a03dc436a5e493e44201b55e606e79b5a13bd0b8e7bcb062f1f033b15dbd47c3bc31d9b2e3336a181259d90da27f2e1434

    Download Submit

  • C:\Users\Admin\AppData\Roaming\123.exe
    Filesize

    701KB

    MD5

    23d41c3c86b454bcda5886fa688d93ec

    SHA1

    ae7b5e74dbe8e0f43eda3532ae85e7e50f84a05d

    SHA256

    832b6a7cbf95224da05cea4a36b37bbde2eece2751d3a385e8a212b0fde4cbb0

    SHA512

    f45418755562d46c402fc66135e744a03dc436a5e493e44201b55e606e79b5a13bd0b8e7bcb062f1f033b15dbd47c3bc31d9b2e3336a181259d90da27f2e1434

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tracking_Number.js
    Filesize

    2.7MB

    MD5

    8e122b0422b77f4d07ecac2f4f929a15

    SHA1

    ca408811c60df8a40b931efb068aac902e1b9be5

    SHA256

    ad60c7fbb5091333bd629e004746047d4da7af3cb57b1a28df061baf0f7008c7

    SHA512

    458329583e64936cb5d0beb5e6bcfe802f9cc01e3b503ab66d923283388d177d4ce63e62c7cbef441f4ba1e821afa670f532f75eb9fc8fe6598192163ec0329c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tracking_Number.js
    Filesize

    2.7MB

    MD5

    19c5045d74bd6d55551c00910f44e3cb

    SHA1

    fa656d4789cc9f0ec6e3cd211b90eda57302c3ef

    SHA256

    1ee08a9037a820ccadbc782796577fb8581c0003d3f53201510fded41788ddd1

    SHA512

    516771d1bc03cfc404d99681472f2cd09c88ebc71c00c083923807154e257d4aca087d7ab9f05a74152259199223de1b2458af0e5aff0a9aea44f86c7fda0433

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sCmQSwcNNH.js
    Filesize

    346KB

    MD5

    ddd86f3f3317db8d3976edbba41483dc

    SHA1

    3302b16e470d9d3dff221a9ed63e4b7d6a846d7f

    SHA256

    d1fae4d587ac0ab289ff6ad45d9363c62068f120bc7aa8c88d411aaefdea12d5

    SHA512

    7eacfe75e8f214c11cbdad8ebd0b4dd818717541e191dfcf42fbb736953e350156ec3359e93bd572f93852487a85fa2335edd5256b49f4a7cdf2b20876723e1c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Tracking_Number.js
    Filesize

    2.7MB

    MD5

    19c5045d74bd6d55551c00910f44e3cb

    SHA1

    fa656d4789cc9f0ec6e3cd211b90eda57302c3ef

    SHA256

    1ee08a9037a820ccadbc782796577fb8581c0003d3f53201510fded41788ddd1

    SHA512

    516771d1bc03cfc404d99681472f2cd09c88ebc71c00c083923807154e257d4aca087d7ab9f05a74152259199223de1b2458af0e5aff0a9aea44f86c7fda0433

    Download Submit

  • C:\Users\Admin\AppData\Roaming\sCmQSwcNNH.js
    Filesize

    346KB

    MD5

    ddd86f3f3317db8d3976edbba41483dc

    SHA1

    3302b16e470d9d3dff221a9ed63e4b7d6a846d7f

    SHA256

    d1fae4d587ac0ab289ff6ad45d9363c62068f120bc7aa8c88d411aaefdea12d5

    SHA512

    7eacfe75e8f214c11cbdad8ebd0b4dd818717541e191dfcf42fbb736953e350156ec3359e93bd572f93852487a85fa2335edd5256b49f4a7cdf2b20876723e1c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\sCmQSwcNNH.js
    Filesize

    346KB

    MD5

    ddd86f3f3317db8d3976edbba41483dc

    SHA1

    3302b16e470d9d3dff221a9ed63e4b7d6a846d7f

    SHA256

    d1fae4d587ac0ab289ff6ad45d9363c62068f120bc7aa8c88d411aaefdea12d5

    SHA512

    7eacfe75e8f214c11cbdad8ebd0b4dd818717541e191dfcf42fbb736953e350156ec3359e93bd572f93852487a85fa2335edd5256b49f4a7cdf2b20876723e1c

    Download Submit

  • memory/2060-341-0x0000000004D90000-0x0000000004DA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2060-311-0x0000000004D90000-0x0000000004DA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2060-286-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

    Download

  • memory/2284-169-0x00000000058E0000-0x0000000005972000-memory.dmp

    Filesize

    584KB

    Download

  • memory/2284-171-0x0000000006FB0000-0x000000000704C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/2284-170-0x0000000005840000-0x000000000584A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2284-168-0x0000000005830000-0x0000000005840000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2284-167-0x0000000005DF0000-0x0000000006394000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/2284-166-0x0000000000B30000-0x0000000000BE6000-memory.dmp

    Filesize

    728KB

    Download

  • memory/3908-175-0x0000000002B50000-0x0000000002B51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4800-181-0x000001CED0A60000-0x000001CED0A80000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4800-184-0x000001CED0A20000-0x000001CED0A40000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4800-188-0x000001CED0E30000-0x000001CED0E50000-memory.dmp

    Filesize

    128KB

    Download