vjw0rm | 1ddb17729c8fcc03d0b2f3289463ed3032b5af85a0628f842b095a26bb066c59

General

Target

Receipt #43645488.js
Size

51KB
MD5

1587a7855b342770c687c789959c6b99
SHA1

07b97a47e3e409e9635debe66087afcef57194a6
SHA256

1ddb17729c8fcc03d0b2f3289463ed3032b5af85a0628f842b095a26bb066c59
SHA512

9c71fe1839dc5c45a42364c9626b9237cf078e9cb9ffa5c92d44ea68bfa414226f19341e546cf86c57d17e724f82176ad1d73f1f4d8ffe849f777b4e98963035

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Extracted

Family

vjw0rm

C2

http://ecolo.duckdns.org:26008

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 7 IoCs

Processes:

wscript.exewscript.exe

flow pid process

10 2312 wscript.exe
11 732 wscript.exe
26 2312 wscript.exe
35 2312 wscript.exe
41 2312 wscript.exe
42 2312 wscript.exe
43 2312 wscript.exe

flow	pid	process
10	2312	wscript.exe
11	732	wscript.exe
26	2312	wscript.exe
35	2312	wscript.exe
41	2312	wscript.exe
42	2312	wscript.exe
43	2312	wscript.exe

Drops startup file 4 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wAirxpmRXf.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wAirxpmRXf.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Receipt #43645488.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Receipt #43645488.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\wAirxpmRXf.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\QMKYOV5VW3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Receipt #43645488.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2192 schtasks.exe

pid	process
2192	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 732 wrote to memory of 2312	732	wscript.exe	wscript.exe
PID 732 wrote to memory of 2312	732	wscript.exe	wscript.exe
PID 732 wrote to memory of 2192	732	wscript.exe	schtasks.exe
PID 732 wrote to memory of 2192	732	wscript.exe	schtasks.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Receipt #43645488.js"
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\wAirxpmRXf.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2312

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\Receipt #43645488.js
2⤵
- Creates scheduled task(s)
PID:2192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\wAirxpmRXf.js
MD5
80d8cf13462956920415d1bfbc6da232

SHA1
41bd938c6dc0a483897982e38f34aa3d4b3e14be

SHA256
f234f27cdd386b39033676b64e8dd4002602840c3c93e9654bc0795ebdb92289

SHA512
04021ab6dda56795c5a81865a35d4aef6574e8428e6e105064107d4816dcb3968c85c69dc5afdca506d68ea42b6423f0c32110ef8e2652831fd24790cc016e9b

Download Submit
memory/2192-117-0x0000000000000000-mapping.dmp

Download
memory/2312-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads