vjw0rm | 94141506892544ed661a863292f5497e99a094efd9ca7c96cb64439a5d1af575

General

Target

45678-INVOICE.js
Size

31KB
MD5

05928625d3fe939ab6193d512b5b5d40
SHA1

9bc4473a08f10d3637a81f14728260d04d0978f4
SHA256

94141506892544ed661a863292f5497e99a094efd9ca7c96cb64439a5d1af575
SHA512

da25f7a9fa999fb48e095a0d61d15a640d50801a158479e5b7fa08b50fb1c901fc031819f18435817cf98f72e665183b194216f61f225beb0e5c821b47ed85c8

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 33 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
21	4016	wscript.exe
22	1720	wscript.exe
28	1720	wscript.exe
29	4016	wscript.exe
30	1720	wscript.exe
31	4016	wscript.exe
32	1720	wscript.exe
33	4016	wscript.exe
34	1720	wscript.exe
35	4016	wscript.exe
36	1720	wscript.exe
37	4016	wscript.exe
38	1720	wscript.exe
39	4016	wscript.exe
41	1720	wscript.exe
42	4016	wscript.exe
43	1720	wscript.exe
44	4016	wscript.exe
45	1720	wscript.exe
46	4016	wscript.exe
47	1720	wscript.exe
48	4016	wscript.exe
49	1720	wscript.exe
50	4016	wscript.exe
51	1720	wscript.exe
52	4016	wscript.exe
53	1720	wscript.exe
54	4016	wscript.exe
55	1720	wscript.exe
56	4016	wscript.exe
57	1720	wscript.exe
58	4016	wscript.exe
59	1720	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\laeapoOSVO.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\laeapoOSVO.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\laeapoOSVO.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 4016 wrote to memory of 1720	4016	wscript.exe	wscript.exe
PID 4016 wrote to memory of 1720	4016	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\45678-INVOICE.js
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4016

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\laeapoOSVO.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\laeapoOSVO.js
MD5
e2f8f780d50a72b875b0abc09a17e722

SHA1
2a855bde603dc98064d74b0710cf3efb26fa213d

SHA256
c9241561fc88d183db872fb1daa5438b5d836a2b16cf020ac011099a95d2a6cc

SHA512
065fb5584160fc053d792896700c50c244da2a9655fb893dc76fc3a2e200d825b00bceebf8dd9960e203b76e6cd7ab1d6afb98b74e7b078876e34446e4149bf1

Download Submit
memory/1720-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads