vjw0rm | 68378f29c28f5c114262352e6f090391f3ca783181750b9f59911dcdb8f4c976

General

Target

PROOF OF PAYMENT1.js
Size

207KB
MD5

019ba024bf588f00e256748d936eb626
SHA1

dcf86be244ff99ab838d7f9dc8012533ca16142f
SHA256

68378f29c28f5c114262352e6f090391f3ca783181750b9f59911dcdb8f4c976
SHA512

43faf55150630cb87ea01d2595ca792a20fb7ece259296cb1829b243f22e784645a484ee5789650f8933fba05dafebe299d9441144f785f1bfe34f2e0af13e3a

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 18 IoCs

Processes:

WScript.exe

flow	pid	process
9	2980	WScript.exe
14	2980	WScript.exe
17	2980	WScript.exe
18	2980	WScript.exe
19	2980	WScript.exe
20	2980	WScript.exe
21	2980	WScript.exe
22	2980	WScript.exe
23	2980	WScript.exe
24	2980	WScript.exe
25	2980	WScript.exe
26	2980	WScript.exe
27	2980	WScript.exe
28	2980	WScript.exe
29	2980	WScript.exe
30	2980	WScript.exe
31	2980	WScript.exe
32	2980	WScript.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CSaGqYEkCZ.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CSaGqYEkCZ.js	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\CSaGqYEkCZ.js\""	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2832 2256 WerFault.exe javaw.exe
Modifies registry class 1 IoCs

Processes:

wscript.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings wscript.exe

pid	pid_target	process	target process
2832	2256	WerFault.exe	javaw.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	wscript.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe
2832	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2832 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2832	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1428 wrote to memory of 2980	1428	wscript.exe	WScript.exe
PID 1428 wrote to memory of 2980	1428	wscript.exe	WScript.exe
PID 1428 wrote to memory of 2256	1428	wscript.exe	javaw.exe
PID 1428 wrote to memory of 2256	1428	wscript.exe	javaw.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PROOF OF PAYMENT1.js"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\CSaGqYEkCZ.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2980

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\xmtobgt.txt"
2⤵
PID:2256

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2256 -s 356
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\CSaGqYEkCZ.js
MD5
e7a8ca9c9fccca22054654ab0ecbba32

SHA1
ebcffc54aaafb74d1f881ee535dad9e14e3944fa

SHA256
a09ea45e53024c5f72ea6485eeadd9e80b38d9cbd8e1e82cee88e6291ea25031

SHA512
7bd25e67af83810bbe001f146a8b5e39ba792db36a2ac0b0dd7c62f87a6da1257d652e9ec932b89067cea5c98dcd21900f0be820baffc454f0d011ac21c776c5

Download Submit
C:\Users\Admin\AppData\Roaming\xmtobgt.txt
MD5
23c93de4b1f7d9fdb680da960a8858a9

SHA1
029a3c28cae69273dd2e70481f990808f3f414ce

SHA256
4d6186fdf512e6f098a30bea6fa0810167e023d9c840209fc36593f9fa4470cc

SHA512
9653abcb715745a7b837e6b436b4f57ea0205a31d82f2e8badc95907714180735f839db46a4249e3fb3a606b104c27f17bac0b8d7a954cba52636a453946dac6

Download Submit
memory/2256-116-0x0000000000000000-mapping.dmp

Download
memory/2980-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads