vjw0rm | 3455386680d2443e47c0931ec1ffc3f1db1f1744dd0b35d66d6a8d66f976e7d4

General

Target

UPS 1ZF1939R0198605672.js
Size

85KB
MD5

cecc5ef246b78035fd37775f6a09424e
SHA1

a7f6ca9e2ecea0a8a7dacabbdaecfe3659497f6e
SHA256

3455386680d2443e47c0931ec1ffc3f1db1f1744dd0b35d66d6a8d66f976e7d4
SHA512

df92e9c94c02bc6cf2c8d7701a5bbfd637a0516fe5c8f209f416e290e4d5fcc6aa37e0cd50e8044db74599c16380f49138b451516f98ce0bf5f990e553dc83b1

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Extracted

Family

vjw0rm

C2

http://spdxx.ddns.net:5050

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 7 IoCs

Processes:

wscript.exewscript.exe

flow pid process

10 2656 wscript.exe
11 1832 wscript.exe
29 1832 wscript.exe
31 1832 wscript.exe
35 1832 wscript.exe
36 1832 wscript.exe
37 1832 wscript.exe

flow	pid	process
10	2656	wscript.exe
11	1832	wscript.exe
29	1832	wscript.exe
31	1832	wscript.exe
35	1832	wscript.exe
36	1832	wscript.exe
37	1832	wscript.exe

Drops startup file 4 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wQtCVbovFT.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wQtCVbovFT.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UPS 1ZF1939R0198605672.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UPS 1ZF1939R0198605672.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\R4J2SBXQ4G = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UPS 1ZF1939R0198605672.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\wQtCVbovFT.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

804 schtasks.exe

pid	process
804	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 2656 wrote to memory of 1832	2656	wscript.exe	wscript.exe
PID 2656 wrote to memory of 1832	2656	wscript.exe	wscript.exe
PID 2656 wrote to memory of 804	2656	wscript.exe	schtasks.exe
PID 2656 wrote to memory of 804	2656	wscript.exe	schtasks.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\UPS 1ZF1939R0198605672.js"
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\wQtCVbovFT.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1832

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\UPS 1ZF1939R0198605672.js
2⤵
- Creates scheduled task(s)
PID:804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\wQtCVbovFT.js
MD5
3eafd1013a7470f51158442dacc7479d

SHA1
d31e8864e972f7866b2551ae64d4165fbda7e6cd

SHA256
130f520fe9f2e01ec06f61e2390ae8babaa3b616be04be6c676284d963e334b2

SHA512
9cbce6303ca77d6b4da1de93ecb5b7ec78cce368b31da494cf165ebfc13d5db72f732925ce7fc3f8af6ba5d2dca01cb86b40d225db2c91bedfcf65a561386b0b

Download Submit
memory/804-117-0x0000000000000000-mapping.dmp

Download
memory/1832-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads