vjw0rm | 79d19fef3bb8d0bdcea5bb260dd8ef143c7d39e26fb99b734af8c630a5fd5dc4

General

Target
Waybill.js
Size 22KB
Sample211118-sblntaecbp
SHA256 79d19fef3bb8d0bdcea5bb260dd8ef143c7d39e26fb99b734af8c630a5fd5dc4
MD5 6d4a3b384063526d3db581640141592d
SHA1 771da1ff9b3445d89631c6699da9e17a48f017ff
SHA512 689d4ad9c540b208163764bf466b398293a046d80c4c8ac67ac9656edda24b19c8ce630a31da7839c9f90b696f893b5ed57f7f3277af0408adddad2656469be5
MD5 SHA1 SHA512

Score

10^/10

Family

C2

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	3124	wscript.exe
10	3672	wscript.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AZKBxyhpHB.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AZKBxyhpHB.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Waybill.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Waybill.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\AZKBxyhpHB.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\M1QTHFVHNE = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Waybill.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1928	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3124	3672	wscript.exe	68
PID 3672 wrote to memory of 3124	3672	wscript.exe	68
PID 3672 wrote to memory of 1928	3672	wscript.exe	70
PID 3672 wrote to memory of 1928	3672	wscript.exe	70

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Waybill.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\AZKBxyhpHB.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:3124
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\Waybill.js
  2⤵
  - Creates scheduled task(s)
  PID:1928