vjw0rm | cbac4352809b67ce8ca478aa691887703a8427e6109aec32a0f331f19c922182

General

Target

2bd78f7o2s.js
Size

8KB
MD5

1e0330ddc63816047d0cf469ec4bd846
SHA1

a8096b7151fbb5d279c11fc561b00a2a235adbaf
SHA256

cbac4352809b67ce8ca478aa691887703a8427e6109aec32a0f331f19c922182
SHA512

31b36628b9f3ab65817337848f92f6cb19dd9ec5e953803ceb3a9054468ee6229e8bb87053d722701bc6e8ec1bf3ac2b8b548c68a67c872588d097cf2a93ff83

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 64 IoCs

Processes:

wscript.exe

flow	pid	process
6	3624	wscript.exe
14	3624	wscript.exe
16	3624	wscript.exe
17	3624	wscript.exe
18	3624	wscript.exe
19	3624	wscript.exe
20	3624	wscript.exe
21	3624	wscript.exe
22	3624	wscript.exe
23	3624	wscript.exe
24	3624	wscript.exe
25	3624	wscript.exe
26	3624	wscript.exe
27	3624	wscript.exe
28	3624	wscript.exe
29	3624	wscript.exe
30	3624	wscript.exe
31	3624	wscript.exe
32	3624	wscript.exe
33	3624	wscript.exe
34	3624	wscript.exe
35	3624	wscript.exe
36	3624	wscript.exe
37	3624	wscript.exe
38	3624	wscript.exe
39	3624	wscript.exe
40	3624	wscript.exe
41	3624	wscript.exe
42	3624	wscript.exe
43	3624	wscript.exe
44	3624	wscript.exe
45	3624	wscript.exe
46	3624	wscript.exe
47	3624	wscript.exe
54	3624	wscript.exe
55	3624	wscript.exe
56	3624	wscript.exe
57	3624	wscript.exe
58	3624	wscript.exe
59	3624	wscript.exe
60	3624	wscript.exe
63	3624	wscript.exe
64	3624	wscript.exe
65	3624	wscript.exe
66	3624	wscript.exe
67	3624	wscript.exe
68	3624	wscript.exe
69	3624	wscript.exe
70	3624	wscript.exe
71	3624	wscript.exe
72	3624	wscript.exe
73	3624	wscript.exe
74	3624	wscript.exe
75	3624	wscript.exe
76	3624	wscript.exe
77	3624	wscript.exe
78	3624	wscript.exe
79	3624	wscript.exe
80	3624	wscript.exe
81	3624	wscript.exe
82	3624	wscript.exe
83	3624	wscript.exe
84	3624	wscript.exe
85	3624	wscript.exe

Drops startup file 3 IoCs

Processes:

wscript.exeWScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2bd78f7o2s.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2bd78f7o2s.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2bd78f7o2s.js	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exeWScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\GF5EHB4I0U = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2bd78f7o2s.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\GF5EHB4I0U = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2bd78f7o2s.js\""	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1944 schtasks.exe
3844 schtasks.exe

pid	process
1944	schtasks.exe
3844	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.exeWScript.exe

description	pid	process	target process
PID 3624 wrote to memory of 1944	3624	wscript.exe	schtasks.exe
PID 3624 wrote to memory of 1944	3624	wscript.exe	schtasks.exe
PID 3812 wrote to memory of 3844	3812	WScript.exe	schtasks.exe
PID 3812 wrote to memory of 3844	3812	WScript.exe	schtasks.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\2bd78f7o2s.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3624

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\2bd78f7o2s.js
2⤵
- Creates scheduled task(s)
PID:1944

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\2bd78f7o2s.js"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3812

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\2bd78f7o2s.js
2⤵
- Creates scheduled task(s)
PID:3844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2bd78f7o2s.js
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1944-114-0x0000000000000000-mapping.dmp

Download
memory/3844-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads