vjw0rm | c8602635235e660c6fb7c8f69ea586482c972a807d7dac0cc81c56fcf0d93e02

General

Target

763904f1_U2aZzq1vXW.js
Size

208KB
MD5

763904f17e55bb5bfa038bed7a3a3ff6
SHA1

0bbbf2007444d743e13ae8666cf55fd2e40fc6ff
SHA256

c8602635235e660c6fb7c8f69ea586482c972a807d7dac0cc81c56fcf0d93e02
SHA512

4c7eee1a479aa9f22271a99419e3cf076203ed035e49ef1b9f02361855213d4b75015f3d5e1d065de5c0cbf71031ffc18afe766ff38246c8dbca56c5a5e4494e

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 18 IoCs

Processes:

WScript.exe

flow	pid	process
9	2436	WScript.exe
18	2436	WScript.exe
20	2436	WScript.exe
21	2436	WScript.exe
22	2436	WScript.exe
23	2436	WScript.exe
24	2436	WScript.exe
25	2436	WScript.exe
26	2436	WScript.exe
27	2436	WScript.exe
28	2436	WScript.exe
29	2436	WScript.exe
30	2436	WScript.exe
31	2436	WScript.exe
32	2436	WScript.exe
33	2436	WScript.exe
34	2436	WScript.exe
35	2436	WScript.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bGhayglGGp.js	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bGhayglGGp.js	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\bGhayglGGp.js\""	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2952 3004 WerFault.exe javaw.exe
Modifies registry class 1 IoCs

Processes:

wscript.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings wscript.exe

pid	pid_target	process	target process
2952	3004	WerFault.exe	javaw.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	wscript.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2952 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2952	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 3008 wrote to memory of 2436	3008	wscript.exe	WScript.exe
PID 3008 wrote to memory of 2436	3008	wscript.exe	WScript.exe
PID 3008 wrote to memory of 3004	3008	wscript.exe	javaw.exe
PID 3008 wrote to memory of 3004	3008	wscript.exe	javaw.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\763904f1_U2aZzq1vXW.js
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\bGhayglGGp.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2436

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\xvetlv.txt"
2⤵
PID:3004

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3004 -s 356
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\bGhayglGGp.js

MD5
3d29800f4ac80ec11fb83220c10166af

SHA1
563f6b81b3ca00b5f483e1fad62b511e62d1cf6b

SHA256
3d98b5e35da71ddf286f92d2cdb33fb631c95f90ff11e31ba53c236c6758b3d7

SHA512
e71ac8e739872ae451d2780f07c3262e44ffab582654be439d96db52c5b0eef7d724177c169f16b6725c1c2bf48a44097792c4eb5310d4e2c327dcd28c387cf7

Download Submit
C:\Users\Admin\AppData\Roaming\xvetlv.txt

MD5
2609351f059049d57f3c3acb42f6ceba

SHA1
f028f2c40bd349772b0ee2a50ce15faa692e5b90

SHA256
050bd188e324cf2070656fda15505df4e8663377e7a62bc5cb7d3fceefdde25f

SHA512
d797b768fc8adf63776f6011695a63998729c4a227c4002ec9cbe52e2431d50496e745c2833ee00db951dde49b3c2ba4692d01057253b5259a65d0aa5f8208ea

Download Submit
memory/2436-114-0x0000000000000000-mapping.dmp

Download
memory/3004-116-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads