vjw0rm | 3bc609eb0e2d3a32c2036a43005ecca2698dd78b277c8bfeba5172f4a787ed22

General

Target

Order_KV240621.js
Size

30KB
MD5

4468c180cb09231b55e22ddfb4a6aff4
SHA1

e8a8b07df75f08e06e8d3e4eeb59a07491b01627
SHA256

3bc609eb0e2d3a32c2036a43005ecca2698dd78b277c8bfeba5172f4a787ed22
SHA512

b580a4b86500eeb90b2494fc528104c2ef74df682e5c778022d9c18d873648baee85df0118f7bf3774d07a8091319eac185c0c10b8a0dfff4d5005aa3bc6b51e

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 38 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
8	4044	wscript.exe
9	1952	wscript.exe
17	1952	wscript.exe
20	1952	wscript.exe
21	1952	wscript.exe
22	1952	wscript.exe
23	1952	wscript.exe
24	1952	wscript.exe
25	1952	wscript.exe
26	1952	wscript.exe
27	1952	wscript.exe
28	1952	wscript.exe
29	1952	wscript.exe
30	1952	wscript.exe
31	1952	wscript.exe
32	1952	wscript.exe
33	1952	wscript.exe
34	1952	wscript.exe
35	1952	wscript.exe
36	1952	wscript.exe
37	1952	wscript.exe
38	1952	wscript.exe
39	1952	wscript.exe
40	1952	wscript.exe
41	1952	wscript.exe
42	1952	wscript.exe
43	1952	wscript.exe
44	1952	wscript.exe
45	1952	wscript.exe
46	1952	wscript.exe
47	1952	wscript.exe
48	1952	wscript.exe
49	1952	wscript.exe
50	1952	wscript.exe
51	1952	wscript.exe
56	1952	wscript.exe
60	1952	wscript.exe
61	1952	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SGItIKOubx.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SGItIKOubx.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\SGItIKOubx.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 4044 wrote to memory of 1952	4044	wscript.exe	wscript.exe
PID 4044 wrote to memory of 1952	4044	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Order_KV240621.js
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\SGItIKOubx.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SGItIKOubx.js
MD5
7c6fe111fde9833622301768eedf9300

SHA1
ec58697f4c1d74a88abaee1e9b65ed41770447d2

SHA256
972e6a287063b21f85eaca5374db4296bcfe510f11b7140def63f2e649dda7e8

SHA512
6a4a4df4660f0921ead55a77d1f8a0d656f1ecbcde3bce411cfb86f6b556fed2504212ed4972a7454050edfb14a80be59a0571fb3c8021b69af921ff738c3ec6

Download Submit
memory/1952-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads