vjw0rm | 38bc8e04a65baa0f11a07ded66dfb062c37e960f256e1b56b87f5c4eeddbc477

General

Target

36516993__hcKJCiJRb.js
Size

205KB
MD5

3651699399191612d62b1061315f9742
SHA1

f3519916f500307bc3d8f0aee62d481c8d8593b9
SHA256

38bc8e04a65baa0f11a07ded66dfb062c37e960f256e1b56b87f5c4eeddbc477
SHA512

7f37ba4338db419a0ede15c20fc293bd913b55479dc6c7ddd93d9ed4440cd5fa98c998b26510e297bcbbb194631ecfc24ba8b8f1870b7689dc9afc56a10a8fb9

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 18 IoCs

Processes:

WScript.exe

flow	pid	process
8	3984	WScript.exe
18	3984	WScript.exe
19	3984	WScript.exe
20	3984	WScript.exe
21	3984	WScript.exe
22	3984	WScript.exe
23	3984	WScript.exe
24	3984	WScript.exe
25	3984	WScript.exe
26	3984	WScript.exe
27	3984	WScript.exe
28	3984	WScript.exe
29	3984	WScript.exe
30	3984	WScript.exe
31	3984	WScript.exe
32	3984	WScript.exe
33	3984	WScript.exe
34	3984	WScript.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SFkYeHqdOZ.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SFkYeHqdOZ.js	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\SFkYeHqdOZ.js\""	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2772 3920 WerFault.exe javaw.exe
Modifies registry class 1 IoCs

Processes:

wscript.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings wscript.exe

pid	pid_target	process	target process
2772	3920	WerFault.exe	javaw.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	wscript.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe
2772	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2772 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2772	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 632 wrote to memory of 3984	632	wscript.exe	WScript.exe
PID 632 wrote to memory of 3984	632	wscript.exe	WScript.exe
PID 632 wrote to memory of 3920	632	wscript.exe	javaw.exe
PID 632 wrote to memory of 3920	632	wscript.exe	javaw.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\36516993__hcKJCiJRb.js
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\SFkYeHqdOZ.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:3984

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\kmfzjnj.txt"
2⤵
PID:3920

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3920 -s 352
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SFkYeHqdOZ.js

MD5
0d2e70152b432678c45a8062f6094102

SHA1
4b514ed3794f3a67734cf8c0b5ce215ee862ec6b

SHA256
773a2b1f276bb89485df23c68c41fe27a290d684f9147a62345d570ab5e23034

SHA512
67e9fb51af4b2dbcd17aaefa2b5f252ea7225028c0cd669490699a4d7d04e038fd85ae963168c3d317c1376087afb7171589c3894efb20abb344da42f9aea434

Download Submit
C:\Users\Admin\AppData\Roaming\kmfzjnj.txt

MD5
2609351f059049d57f3c3acb42f6ceba

SHA1
f028f2c40bd349772b0ee2a50ce15faa692e5b90

SHA256
050bd188e324cf2070656fda15505df4e8663377e7a62bc5cb7d3fceefdde25f

SHA512
d797b768fc8adf63776f6011695a63998729c4a227c4002ec9cbe52e2431d50496e745c2833ee00db951dde49b3c2ba4692d01057253b5259a65d0aa5f8208ea

Download Submit
memory/3920-116-0x0000000000000000-mapping.dmp

Download
memory/3984-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads