vjw0rm | fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85

Analysis

max time kernel
151s
max time network
197s
platform
windows7_x64
resource
win7v20210410
submitted
19-08-2021 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85.js
Size

19KB
MD5

40226ee8e5ccd983ec7446b068819477
SHA1

9417c77384776b685a98293d0416646b18dddf01
SHA256

fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85
SHA512

c09bdd3943bd724ac4e13fe6d32061cf54b0af7b726b6f777ba5621c57d6876db683a95ef2d7da95052a7284072f48dc8f5fbf0422d00e275c6026c097ab8cd1

Score

10^/10

vjw0rm trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 18 IoCs

Processes:

wscript.exe

flow	pid	process
7	1932	wscript.exe
8	1932	wscript.exe
9	1932	wscript.exe
11	1932	wscript.exe
12	1932	wscript.exe
13	1932	wscript.exe
15	1932	wscript.exe
16	1932	wscript.exe
17	1932	wscript.exe
19	1932	wscript.exe
20	1932	wscript.exe
21	1932	wscript.exe
23	1932	wscript.exe
24	1932	wscript.exe
25	1932	wscript.exe
27	1932	wscript.exe
28	1932	wscript.exe
29	1932	wscript.exe

Drops startup file 1 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85.js	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1640 schtasks.exe

pid	process
1640	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1932 wrote to memory of 1640	1932	wscript.exe	schtasks.exe
PID 1932 wrote to memory of 1640	1932	wscript.exe	schtasks.exe
PID 1932 wrote to memory of 1640	1932	wscript.exe	schtasks.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\fe310b776855f95612a6f8633c73df693a8b940bc10b2109e2c51f54be398b85.js
2⤵
- Creates scheduled task(s)
PID:1640

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-60-0x0000000000000000-mapping.dmp

Download