vjw0rm | ec12c4a76b8aaaae0bc169b3a974d0b68dda705150fac4dbecd26486f157c039

General

Target

eReceipt.js
Size

24KB
MD5

53e80f5441f77abf03ac535d2ea55327
SHA1

d1accac81fc1e6afaa92a563bff1cd124dbc7ae2
SHA256

ec12c4a76b8aaaae0bc169b3a974d0b68dda705150fac4dbecd26486f157c039
SHA512

27495d649d80dd0814091cafddd067cd866fe9609684d4d2b1e3937aeb845e6403573dfba5d9ef971e94670b2eb8a7be4520b2caf6d142554c6578ad6eb91958

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 37 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
10	3336	wscript.exe
11	2352	wscript.exe
20	2352	wscript.exe
21	3336	wscript.exe
28	2352	wscript.exe
29	3336	wscript.exe
30	2352	wscript.exe
31	3336	wscript.exe
32	2352	wscript.exe
33	3336	wscript.exe
34	2352	wscript.exe
35	3336	wscript.exe
36	2352	wscript.exe
37	3336	wscript.exe
38	2352	wscript.exe
39	3336	wscript.exe
42	2352	wscript.exe
43	3336	wscript.exe
44	2352	wscript.exe
45	3336	wscript.exe
46	2352	wscript.exe
47	3336	wscript.exe
48	2352	wscript.exe
49	3336	wscript.exe
50	2352	wscript.exe
51	3336	wscript.exe
52	2352	wscript.exe
53	3336	wscript.exe
54	2352	wscript.exe
55	3336	wscript.exe
56	2352	wscript.exe
57	3336	wscript.exe
58	2352	wscript.exe
59	3336	wscript.exe
60	2352	wscript.exe
61	3336	wscript.exe
62	2352	wscript.exe

Drops startup file 3 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xTZBMhzFuE.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xTZBMhzFuE.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\xTZBMhzFuE.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\3W2CQPM6PM = "\"C:\\Users\\Admin\\AppData\\Roaming\\eReceipt.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 2352 wrote to memory of 3336	2352	wscript.exe	wscript.exe
PID 2352 wrote to memory of 3336	2352	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\eReceipt.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xTZBMhzFuE.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:3336

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\xTZBMhzFuE.js
MD5
c723c09e07ec54a2833fdd1cf2adcee3

SHA1
9acabb132972ac2dc178e396a903258c61a3adc9

SHA256
0d231c7df5c5c19a43d3992e654b6fbbe7fd32b8a66040471dbe398a35947f04

SHA512
1ccaeaab8ee01dd7b152e665941094dac1af6b73e8a12c713615be89c95bd8ce76a8c99547ca5f366d63bb71c45a0e15dab0930f0c8cf771cc6ff72ca2c976c2

Download Submit
memory/3336-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads