vjw0rm | 2f2b1b66553a447bb3384f5d22407a00bedefc43f5d4fb63b8b4970ed6c1702f

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2023 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

neworder.js
Size

3.8MB
MD5

7d1e985be05e1038b33ae1c4e980a663
SHA1

364d4a8f587b94716daaec3ce4ed80d00b356c0c
SHA256

2f2b1b66553a447bb3384f5d22407a00bedefc43f5d4fb63b8b4970ed6c1702f
SHA512

754ee17cdbcd34b2201dc47a92f86f9e7f8cd8aa82969c6a3970d02b8bec33ae19edc9627a011d1554d2935a4a830c5fd769c7f281e95707473e4c55a151c845
SSDEEP

24576:1ZGBVFPB36kJuadeEKwN8o5red0epniTcZkgbMegyMDoIWqkaln8wDs/Pm+x7Dt5:F

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

http://akinbo.ddns.net:6390

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 39 IoCs

flow	pid	Process
8	3928	wscript.exe
10	1304	wscript.exe
11	1032	wscript.exe
22	1032	wscript.exe
26	1032	wscript.exe
30	1032	wscript.exe
33	1032	wscript.exe
45	3928	wscript.exe
46	1032	wscript.exe
47	1304	wscript.exe
48	1032	wscript.exe
49	1032	wscript.exe
50	1032	wscript.exe
51	1032	wscript.exe
52	1032	wscript.exe
53	3928	wscript.exe
54	1304	wscript.exe
55	1032	wscript.exe
58	1032	wscript.exe
61	1032	wscript.exe
63	1032	wscript.exe
64	1032	wscript.exe
67	1032	wscript.exe
68	3928	wscript.exe
69	1304	wscript.exe
70	1032	wscript.exe
71	1032	wscript.exe
72	1032	wscript.exe
73	1032	wscript.exe
74	1032	wscript.exe
75	3928	wscript.exe
76	1304	wscript.exe
77	1032	wscript.exe
78	1032	wscript.exe
79	1032	wscript.exe
80	1032	wscript.exe
81	1032	wscript.exe
82	1032	wscript.exe
83	3928	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neworder.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smLqjlUDtu.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smLqjlUDtu.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neworder.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smLqjlUDtu.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neworder = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\neworder.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neworder = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\neworder.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neworder = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\neworder.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neworder = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\neworder.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 28 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	52	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	55	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	46	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	26	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	33	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	51	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	74	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	79	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	11	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	58	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	61	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	63	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	72	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	78	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	30	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	48	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	49	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	70	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	71	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	22	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	67	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	73	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	77	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	81	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	64	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	80	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	82	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript
HTTP User-Agent header	50	WSHRAT\|6A2E1387\|FEUTZCII\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 24/11/2023\|JavaScript

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 3928	3284	wscript.exe	86
PID 3284 wrote to memory of 3928	3284	wscript.exe	86
PID 3284 wrote to memory of 1032	3284	wscript.exe	87
PID 3284 wrote to memory of 1032	3284	wscript.exe	87
PID 1032 wrote to memory of 1304	1032	wscript.exe	90
PID 1032 wrote to memory of 1304	1032	wscript.exe	90

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\neworder.js
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\smLqjlUDtu.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:3928
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\neworder.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\smLqjlUDtu.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neworder.js

Filesize
3.8MB

MD5
7d1e985be05e1038b33ae1c4e980a663

SHA1
364d4a8f587b94716daaec3ce4ed80d00b356c0c

SHA256
2f2b1b66553a447bb3384f5d22407a00bedefc43f5d4fb63b8b4970ed6c1702f

SHA512
754ee17cdbcd34b2201dc47a92f86f9e7f8cd8aa82969c6a3970d02b8bec33ae19edc9627a011d1554d2935a4a830c5fd769c7f281e95707473e4c55a151c845

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neworder.js

Filesize
64KB

MD5
ef7aaf6b0f47e1c05ce6d55de3efb64c

SHA1
226d935f8434843ccdd88d3e6ea8d1c333364367

SHA256
bf26dc63434f6e89505be7cc965722f08b2a5a0270bb8a84060bd12456e52e65

SHA512
6b2f9ee6c503f87723d0391c353b4fb068cf6fe4ae1c83e4421a891d2d3a92e44c7710b56638d9b042a57def6543a3c1c5f1f6fb4560ab5827535a4ee82dd228

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smLqjlUDtu.js

Filesize
346KB

MD5
5ba184f8b0d55c21c5c44fa4d5167626

SHA1
97ecafc5f5af815c78306e1a93069b5e7b19b664

SHA256
a41c9f6197d9f3e066c58a804569195ece07559c8a8ffb77d7a4536bb36e55b9

SHA512
4596406c51b3724e22716c3d2b96d0a737918d6ffcee140046b7921c4266d8c3590734fcc2da68a3746f8f044629415e3bcf8185a09050611ba1372c2db690f2

Download Submit
C:\Users\Admin\AppData\Roaming\neworder.js

Filesize
3.8MB

MD5
7d1e985be05e1038b33ae1c4e980a663

SHA1
364d4a8f587b94716daaec3ce4ed80d00b356c0c

SHA256
2f2b1b66553a447bb3384f5d22407a00bedefc43f5d4fb63b8b4970ed6c1702f

SHA512
754ee17cdbcd34b2201dc47a92f86f9e7f8cd8aa82969c6a3970d02b8bec33ae19edc9627a011d1554d2935a4a830c5fd769c7f281e95707473e4c55a151c845

Download Submit
C:\Users\Admin\AppData\Roaming\smLqjlUDtu.js

Filesize
346KB

MD5
5ba184f8b0d55c21c5c44fa4d5167626

SHA1
97ecafc5f5af815c78306e1a93069b5e7b19b664

SHA256
a41c9f6197d9f3e066c58a804569195ece07559c8a8ffb77d7a4536bb36e55b9

SHA512
4596406c51b3724e22716c3d2b96d0a737918d6ffcee140046b7921c4266d8c3590734fcc2da68a3746f8f044629415e3bcf8185a09050611ba1372c2db690f2

Download Submit
C:\Users\Admin\AppData\Roaming\smLqjlUDtu.js

Filesize
346KB

MD5
5ba184f8b0d55c21c5c44fa4d5167626

SHA1
97ecafc5f5af815c78306e1a93069b5e7b19b664

SHA256
a41c9f6197d9f3e066c58a804569195ece07559c8a8ffb77d7a4536bb36e55b9

SHA512
4596406c51b3724e22716c3d2b96d0a737918d6ffcee140046b7921c4266d8c3590734fcc2da68a3746f8f044629415e3bcf8185a09050611ba1372c2db690f2

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads