vjw0rm | 95a97e608bdcb900439a3ba07ffb942bba4dea464d6141204f0628bca6102460

Analysis

max time kernel
150s
max time network
157s
platform
windows10_x64
resource
win10v20210408
submitted
11-09-2021 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BTCOPY.js
Size

28KB
MD5

9d724d067e3238d3352de71e94367a8e
SHA1

9045f490135900647cb469dc3505021c3ed5f020
SHA256

95a97e608bdcb900439a3ba07ffb942bba4dea464d6141204f0628bca6102460
SHA512

716891218e1faad85922235e5479f4713c54d83bc17ed9571761de9d9919817e69e2bee444d9661c025ae51fb62f482d2bbfe6161cbf7f45347ea0725b6f4c3b

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 19 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
6	4796	wscript.exe
7	4856	wscript.exe
8	4856	wscript.exe
9	4856	wscript.exe
15	4856	wscript.exe
20	4856	wscript.exe
21	4856	wscript.exe
22	4856	wscript.exe
23	4856	wscript.exe
24	4856	wscript.exe
25	4856	wscript.exe
26	4856	wscript.exe
28	4856	wscript.exe
29	4856	wscript.exe
30	4856	wscript.exe
31	4856	wscript.exe
32	4856	wscript.exe
33	4856	wscript.exe
34	4856	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DNdpNyOvla.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DNdpNyOvla.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\DNdpNyOvla.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 4796 wrote to memory of 4856	4796	wscript.exe	wscript.exe
PID 4796 wrote to memory of 4856	4796	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\BTCOPY.js
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\DNdpNyOvla.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DNdpNyOvla.js

MD5
b03c6a67e34c4a22756cc12ce12efe4f

SHA1
136ab03e2f148920db7ddf9a5ff19b0b6d704aa4

SHA256
f78570eff5bec675d28170c3387b931f3a0dbe100bee457a7a123ae9517ded71

SHA512
292007b960c4da590c1c0dccdb3a35023a2cc3b497a8157c3644966d9bb09aba8523828d01ce04649a7eba5613d316761cdfb264f0f2b447bb31c5df575ab2f5

Download Submit
memory/4856-114-0x0000000000000000-mapping.dmp

Download