vjw0rm | d69c3eeaba1a1738a995d6b2112f5164326619f72a3a2904eb4db384be3b1c97

General

Target

transfer receipt.js
Size

207KB
MD5

edda157bf2126ca7e4d4afede45dd97f
SHA1

4b25ab1cc9e0eb1e9025f04c3565f098f281708a
SHA256

d69c3eeaba1a1738a995d6b2112f5164326619f72a3a2904eb4db384be3b1c97
SHA512

f48063a90965579f58e7ef83f7b9073fb0cfd055fe59eef6e47d1a46cbb4cb18d3eb422bd1267f34dafca0deef7ec7ac06163e2415c1c1513927e51125aa7ad0

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 18 IoCs

Processes:

WScript.exe

flow	pid	process
8	3564	WScript.exe
18	3564	WScript.exe
19	3564	WScript.exe
20	3564	WScript.exe
25	3564	WScript.exe
26	3564	WScript.exe
27	3564	WScript.exe
28	3564	WScript.exe
29	3564	WScript.exe
30	3564	WScript.exe
31	3564	WScript.exe
32	3564	WScript.exe
33	3564	WScript.exe
34	3564	WScript.exe
35	3564	WScript.exe
36	3564	WScript.exe
37	3564	WScript.exe
38	3564	WScript.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZnerGlhArR.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZnerGlhArR.js	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\ZnerGlhArR.js\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3464 3560 WerFault.exe javaw.exe
Modifies registry class 1 IoCs

Processes:

wscript.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings wscript.exe

pid	pid_target	process	target process
3464	3560	WerFault.exe	javaw.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings	wscript.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe
3464	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3464 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	3464	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 4720 wrote to memory of 3564	4720	wscript.exe	WScript.exe
PID 4720 wrote to memory of 3564	4720	wscript.exe	WScript.exe
PID 4720 wrote to memory of 3560	4720	wscript.exe	javaw.exe
PID 4720 wrote to memory of 3560	4720	wscript.exe	javaw.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\transfer receipt.js"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ZnerGlhArR.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:3564

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\aqxkbkv.txt"
2⤵
PID:3560

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3560 -s 352
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ZnerGlhArR.js

MD5
b1870bb91d61db459603d88f526a16e5

SHA1
a959d582156e59db449d1c281dbce146cd0665c0

SHA256
f4996bb85dfba853c937a0cb6650693380f11979720004cffbacb9707f0c85f6

SHA512
992ee303ce51aa02fcda0616f4fec5713b9d9579fc4ef384106c65631042728a31953cf5ea02a790ec9a55d3a2944dc0d4e93d1db14f6f0f1630c57016b0b74a

Download Submit
C:\Users\Admin\AppData\Roaming\aqxkbkv.txt

MD5
85ff71c747c2cffbac3e66073eeee70a

SHA1
9ecad73eb19d076b172c1fee5490aa3fee41b653

SHA256
c8ddcbcbf2326a3d60c085308be847503f2ad845af85afdfd4feaa81ffa084fc

SHA512
79ca5b26a0624a15de610183520fd0c6103779d1dd23c8376792c378ca40b44ca870b7aa9a6fe672ca1a606956d149d06641945187dde45b8c3219f19e277888

Download Submit
memory/3560-117-0x0000000000000000-mapping.dmp

Download
memory/3564-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads