vjw0rm | da496f93b454f899587298a910578d3c133dab195a298462ffbd2e1229b14abf

General

Target

eReceipt.js
Size

25KB
MD5

da308c62cbd20f444b54464c47e74091
SHA1

496dc2eebcd81d7bf1ec3fb00ba3f9dbd819962e
SHA256

da496f93b454f899587298a910578d3c133dab195a298462ffbd2e1229b14abf
SHA512

d4b88169e88a0964a7f8c8ab99f1f03b80cbc121d10ed3089dbde92b4be2962a99d39807516575b0908d90fb17c30755cde2b6ea2b9253da42ec2706e41050dd

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 37 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
10	4088	wscript.exe
11	808	wscript.exe
23	808	wscript.exe
24	4088	wscript.exe
34	808	wscript.exe
35	4088	wscript.exe
36	808	wscript.exe
37	4088	wscript.exe
38	808	wscript.exe
39	4088	wscript.exe
40	808	wscript.exe
41	4088	wscript.exe
42	808	wscript.exe
43	4088	wscript.exe
44	808	wscript.exe
45	4088	wscript.exe
48	808	wscript.exe
49	4088	wscript.exe
50	808	wscript.exe
51	4088	wscript.exe
52	808	wscript.exe
53	4088	wscript.exe
54	808	wscript.exe
55	4088	wscript.exe
56	808	wscript.exe
57	4088	wscript.exe
58	808	wscript.exe
59	4088	wscript.exe
60	808	wscript.exe
61	4088	wscript.exe
62	808	wscript.exe
63	4088	wscript.exe
64	808	wscript.exe
65	4088	wscript.exe
66	808	wscript.exe
67	4088	wscript.exe
68	808	wscript.exe

Drops startup file 3 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WsjTSEyKfj.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WsjTSEyKfj.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\3W2CQPM6PM = "\"C:\\Users\\Admin\\AppData\\Roaming\\eReceipt.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\WsjTSEyKfj.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description pid process target process

PID 808 wrote to memory of 4088 808 wscript.exe wscript.exe
PID 808 wrote to memory of 4088 808 wscript.exe wscript.exe

description	pid	process	target process
PID 808 wrote to memory of 4088	808	wscript.exe	wscript.exe
PID 808 wrote to memory of 4088	808	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\eReceipt.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\WsjTSEyKfj.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WsjTSEyKfj.js
MD5
25eb4a4c27a5fca5e512d6aecd8f66fa

SHA1
dfad977ec05b9ce88d44650887841800257d55d8

SHA256
8745266f0ab63b38d1e55aa5f6aa90c6620391050fac2d7800bbdb5c0ddddfd5

SHA512
394d8cf1f910ca92ddfcb2917249d7d57af1fa85c83d7fdac1a03cd2c956906ee3c84e31c7136f3fb1bfb8a66e0413e3c3c6af185d314db366ee5b27b6bc3f1a

Download Submit
memory/4088-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads