vjw0rm | ce199d986d0d04279edd245f3a0fe115c7c680a214d73feed8a8451b7b7feb94

General

Target

Invoice5697484.js
Size

200KB
MD5

f8f5bed73850632ff591989c5b88f9ee
SHA1

ce9066586bf44f0e77243ebdd6d2ce109cf7bd7a
SHA256

ce199d986d0d04279edd245f3a0fe115c7c680a214d73feed8a8451b7b7feb94
SHA512

72be43f9ce219a02fc9ee7395867e91f9b175fffa3cf6c69800d5a8ab3e7617bf22e56fa5d1506bfc5b81d303f86c4be278debaad472e7a7bd41e10a0b31a9a9

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 18 IoCs

Processes:

WScript.exe

flow	pid	process
6	1624	WScript.exe
7	1624	WScript.exe
8	1624	WScript.exe
10	1624	WScript.exe
11	1624	WScript.exe
12	1624	WScript.exe
14	1624	WScript.exe
15	1624	WScript.exe
16	1624	WScript.exe
18	1624	WScript.exe
19	1624	WScript.exe
20	1624	WScript.exe
22	1624	WScript.exe
23	1624	WScript.exe
24	1624	WScript.exe
26	1624	WScript.exe
27	1624	WScript.exe
28	1624	WScript.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\paCczCKasj.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\paCczCKasj.js	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\paCczCKasj.js\""	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1100 1712 WerFault.exe javaw.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1100 WerFault.exe
1100 WerFault.exe
1100 WerFault.exe
1100 WerFault.exe
1100 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1100 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1100 WerFault.exe

pid	pid_target	process	target process
1100	1712	WerFault.exe	javaw.exe

pid	process
1100	WerFault.exe
1100	WerFault.exe
1100	WerFault.exe
1100	WerFault.exe
1100	WerFault.exe

pid	process
1100	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1100	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

wscript.exejavaw.exe

description	pid	process	target process
PID 1612 wrote to memory of 1624	1612	wscript.exe	WScript.exe
PID 1612 wrote to memory of 1624	1612	wscript.exe	WScript.exe
PID 1612 wrote to memory of 1624	1612	wscript.exe	WScript.exe
PID 1612 wrote to memory of 1712	1612	wscript.exe	javaw.exe
PID 1612 wrote to memory of 1712	1612	wscript.exe	javaw.exe
PID 1612 wrote to memory of 1712	1612	wscript.exe	javaw.exe
PID 1712 wrote to memory of 1100	1712	javaw.exe	WerFault.exe
PID 1712 wrote to memory of 1100	1712	javaw.exe	WerFault.exe
PID 1712 wrote to memory of 1100	1712	javaw.exe	WerFault.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Invoice5697484.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\paCczCKasj.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1624

C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ojvzicof.txt"
2⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1712 -s 140
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ojvzicof.txt
MD5
d586663f3ff01f6ccddc890a9013aad6

SHA1
4ed9f24d7eeda73c96fef0128d991cfab005e0f8

SHA256
a32832b7da66a6c36a28bc5f2d49b70a555980032d4d0f823cf514089e226b59

SHA512
a1b8c0336ee6c8323329ba1c4a892943e238c1dbad15d78bdf5ae4fc089b397c4dce4770dfe03752cddf52819b62106cbb1a960ebaa0c4125df01a42846ebb98

Download Submit
C:\Users\Admin\AppData\Roaming\paCczCKasj.js
MD5
73cccf2fad42bfd86b4a218c256e3fd7

SHA1
f3ff6f9f588f7f8a725e258e984e128f580f28ea

SHA256
495768f61cf6a338ca8e50e5f453a4ce6af19fd5881b3e848cb7741564c8ca57

SHA512
9b86af50aeb1ede45103318d51e55c97c90b4a9aec33e916824c910965f2abb777f8a4d805ad44e4bd4ff92503b7c2f054b7c3b368e26af901a10c48160d9cc5

Download Submit
memory/1100-66-0x0000000000000000-mapping.dmp

Download
memory/1100-68-0x0000000001C60000-0x0000000001C61000-memory.dmp

Filesize
4KB

Download
memory/1612-60-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download
memory/1624-61-0x0000000000000000-mapping.dmp

Download
memory/1712-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads