vjw0rm | 0a55d489ecb61684e15a631f04e7bf5c59e804fdd8419d1dfe1bba60bc43a8db

Analysis

max time kernel
152s
max time network
184s
platform
windows7_x64
resource
win7v20210408
submitted
02-09-2021 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

INVCDVNC.js
Size

31KB
MD5

bb7c26d5d96eb62f3a624b75dc8469d4
SHA1

a91187d1b7c7594bf6abf86c304445be874ac1f0
SHA256

0a55d489ecb61684e15a631f04e7bf5c59e804fdd8419d1dfe1bba60bc43a8db
SHA512

2580a12cea3a8df1f4fff0a7886b47d8016cde04497ee043e85c056fa9becf1ff1319161cbecac535b5e0d8f4653a6fc31fc7c2b14d384b4e7fd152b3ec19aaa

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 19 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
9	832	wscript.exe
10	1972	wscript.exe
11	832	wscript.exe
14	832	wscript.exe
16	832	wscript.exe
18	832	wscript.exe
21	832	wscript.exe
23	832	wscript.exe
26	832	wscript.exe
28	832	wscript.exe
31	832	wscript.exe
32	832	wscript.exe
35	832	wscript.exe
37	832	wscript.exe
40	832	wscript.exe
42	832	wscript.exe
44	832	wscript.exe
46	832	wscript.exe
48	832	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IDNoNZhVzI.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IDNoNZhVzI.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\IDNoNZhVzI.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1972 wrote to memory of 832	1972	wscript.exe	wscript.exe
PID 1972 wrote to memory of 832	1972	wscript.exe	wscript.exe
PID 1972 wrote to memory of 832	1972	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\INVCDVNC.js
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\IDNoNZhVzI.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\IDNoNZhVzI.js
MD5
f3b49707117e05ac2d64d61088edacd4

SHA1
e3493dd639be8105d2e819bcb04d0a1a1b146671

SHA256
79e67e9c0769a3007b8a639f262bb63613c3d6c35ed628a90db419ea6d590e74

SHA512
93c4680f62aee9a7f509d8379ee1a6a37eb013342855d1d64b040b0502558c1b4b732b8583f1fa2dc05ee6215ef55d24c6a90d6130e1b4dd6197a7de5af8336c

Download Submit
memory/832-60-0x0000000000000000-mapping.dmp

Download