vjw0rm | 1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960

General

Target

1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960.js
Size

3.8MB
MD5

4c314b9d39669df27156747da107becc
SHA1

69b2083af009d92a0e358562e037422cb0f30d5e
SHA256

1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960
SHA512

30a6ae1aea3221ef5bb7f8f7193b8c5b13b37df690720eab3c7dc8c770a769bd97b7df597bafeb008755c7e6930f0dda7622805337daff77362e479bcc1ab19a
SSDEEP

49152:wnYqXWFGA7tDzPYDHZt7Ilht7iYR0a+CwUCIVPrROXv54DOC849xV2jXz2FOz:k

Score

10^/10

vjw0rm wshrat persistence trojan worm

Malware Config

Extracted

Family

wshrat

C2

http://46.183.223.73:7000

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 47 IoCs

Processes:

wscript.exewscript.exewscript.exe

flow	pid	process
8	2124	wscript.exe
9	1984	wscript.exe
10	1204	wscript.exe
12	1984	wscript.exe
13	2124	wscript.exe
15	1204	wscript.exe
18	2124	wscript.exe
21	1984	wscript.exe
23	1204	wscript.exe
24	2124	wscript.exe
26	1984	wscript.exe
29	2124	wscript.exe
31	1204	wscript.exe
33	1984	wscript.exe
35	2124	wscript.exe
37	1204	wscript.exe
39	1984	wscript.exe
40	2124	wscript.exe
43	1204	wscript.exe
45	2124	wscript.exe
46	1984	wscript.exe
50	2124	wscript.exe
52	1204	wscript.exe
53	1984	wscript.exe
56	2124	wscript.exe
57	1204	wscript.exe
59	2124	wscript.exe
61	1984	wscript.exe
64	2124	wscript.exe
66	1984	wscript.exe
68	2124	wscript.exe
70	1204	wscript.exe
72	2124	wscript.exe
74	1204	wscript.exe
76	2124	wscript.exe
79	2124	wscript.exe
82	1984	wscript.exe
84	2124	wscript.exe
85	1204	wscript.exe
87	2124	wscript.exe
90	1984	wscript.exe
92	2124	wscript.exe
93	1204	wscript.exe
96	2124	wscript.exe
98	1984	wscript.exe
100	1204	wscript.exe
102	2124	wscript.exe

Drops startup file 5 IoCs

Processes:

wscript.exewscript.exewscript.exewscript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KrxtdWzuVD.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KrxtdWzuVD.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KrxtdWzuVD.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 20 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	59	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	72	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	84	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	45	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	50	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	40	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	68	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	13	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	24	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	92	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	35	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	56	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	29	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	64	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	76	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	79	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	87	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	96	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	8	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript
HTTP User-Agent header	18	WSHRAT\|48DFC225\|GHPZRGFC\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 12/3/2024\|JavaScript

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

wscript.exewscript.exe

description	pid	process	target process
PID 2204 wrote to memory of 1204	2204	wscript.exe	wscript.exe
PID 2204 wrote to memory of 1204	2204	wscript.exe	wscript.exe
PID 2204 wrote to memory of 1204	2204	wscript.exe	wscript.exe
PID 2204 wrote to memory of 2124	2204	wscript.exe	wscript.exe
PID 2204 wrote to memory of 2124	2204	wscript.exe	wscript.exe
PID 2204 wrote to memory of 2124	2204	wscript.exe	wscript.exe
PID 2124 wrote to memory of 1984	2124	wscript.exe	wscript.exe
PID 2124 wrote to memory of 1984	2124	wscript.exe	wscript.exe
PID 2124 wrote to memory of 1984	2124	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960.js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\KrxtdWzuVD.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1204
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\KrxtdWzuVD.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960.js

Filesize
3.8MB

MD5
4c314b9d39669df27156747da107becc

SHA1
69b2083af009d92a0e358562e037422cb0f30d5e

SHA256
1dd3bb76323b4cef240b169318d78ba1a360574382fb2d9f42a1888fe3fc3960

SHA512
30a6ae1aea3221ef5bb7f8f7193b8c5b13b37df690720eab3c7dc8c770a769bd97b7df597bafeb008755c7e6930f0dda7622805337daff77362e479bcc1ab19a

Download Submit
C:\Users\Admin\AppData\Roaming\KrxtdWzuVD.js

Filesize
346KB

MD5
df23d63d03a3f3bbc346c661216a1443

SHA1
2d17a533f3e783d173de526a9841bb896980161f

SHA256
b6c75bec3bac9f66e932372b1646945b0277c45659fcd657f9c0a2f7da625088

SHA512
20574b586f3d78c96a05fe41c16be1e59acdb15f6dc0ba4037d1986769852e8bb1d08b32579fb41bbb71f68cc32170e128e96ee65f42b9dec3f1204ed9d7d662

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads