vjw0rm | 3d49eb4b682f1e8148a65416a63aa2b940bc09f0ecc7cfaaee2eb259edde120a

General

Target

#Z90NSAJRA.js
Size

9KB
MD5

eeba1092f27fc5e0905f7cd8b08ff836
SHA1

ee24cfe1fac3fdc700114abf4d03b7070ceadeb0
SHA256

3d49eb4b682f1e8148a65416a63aa2b940bc09f0ecc7cfaaee2eb259edde120a
SHA512

a532c49e5dfa6b6626680eda846e13379863a1b7ca206468df916e49525f44fe7f0b420f60948c2efb23dfc0cc9e08fb03ce7655508b17f8d85a69a655fe7780

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 3 IoCs

Processes:

wscript.exeWScript.exe

flow pid process

7 3164 wscript.exe
15 3372 WScript.exe
16 3372 WScript.exe

flow	pid	process
7	3164	wscript.exe
15	3372	WScript.exe
16	3372	WScript.exe

Drops startup file 4 IoCs

Processes:

WScript.exewscript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OHYYTNM8TC.js	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\#Z90NSAJRA.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\#Z90NSAJRA.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OHYYTNM8TC.js	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exeWScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ECJ55M0WKI = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\#Z90NSAJRA.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\GF5EHB4I0U = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OHYYTNM8TC.js\""	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2152 schtasks.exe
2760 schtasks.exe
Modifies registry class 1 IoCs

Processes:

wscript.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings wscript.exe

pid	process
2152	schtasks.exe
2760	schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	wscript.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exeWScript.exe

description	pid	process	target process
PID 3164 wrote to memory of 2760	3164	wscript.exe	schtasks.exe
PID 3164 wrote to memory of 2760	3164	wscript.exe	schtasks.exe
PID 3164 wrote to memory of 3372	3164	wscript.exe	WScript.exe
PID 3164 wrote to memory of 3372	3164	wscript.exe	WScript.exe
PID 3372 wrote to memory of 2152	3372	WScript.exe	schtasks.exe
PID 3372 wrote to memory of 2152	3372	WScript.exe	schtasks.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\#Z90NSAJRA.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3164

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\#Z90NSAJRA.js
2⤵
- Creates scheduled task(s)
PID:2760

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OHYYTNM8TC.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3372

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\OHYYTNM8TC.js
3⤵
- Creates scheduled task(s)
PID:2152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OHYYTNM8TC.js
MD5
32c685c15aaa2b32e343ba85f4e180a1

SHA1
295fa6ea3f3e6e1ab76f89f925eac22989481123

SHA256
0ae85775bc587a543986bf17abd500f33060cf20ec4a56dc70202a899b37cea3

SHA512
c877fc444520920ecc817dd1b95c1e3aa1581b4f692b0dac7854289931e4f18f70d714d0c5cfb64b6754b0d94d8dc6c27e945119d31792dd6934f9acc5f9344d

Download Submit
memory/2152-117-0x0000000000000000-mapping.dmp

Download
memory/2760-114-0x0000000000000000-mapping.dmp

Download
memory/3372-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads