vjw0rm | 66bfaf02c2c9f4e686f1ff2947c719e6ff98882c4bd36ca6941f4c37ea2c0dae

General

Target

receipt#.js
Size

129KB
MD5

2018bb31cdcc9ec8205c52c8ce451d29
SHA1

26cdfb744e60ceb196f28ebc72dbea2fb44d9de2
SHA256

66bfaf02c2c9f4e686f1ff2947c719e6ff98882c4bd36ca6941f4c37ea2c0dae
SHA512

b224978e6ff6795beb3500e1dd9631c0f0e8686d65721152bae61a0c183fa3c2d080b049ae5f5736f5617adeae816a781b57570d964584e885d8b7e0b28af62c

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 23 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
8	1728	wscript.exe
9	460	wscript.exe
11	1728	wscript.exe
13	1728	wscript.exe
16	1728	wscript.exe
17	460	wscript.exe
18	1728	wscript.exe
20	1728	wscript.exe
23	1728	wscript.exe
25	460	wscript.exe
27	1728	wscript.exe
29	1728	wscript.exe
31	1728	wscript.exe
34	1728	wscript.exe
36	460	wscript.exe
38	1728	wscript.exe
40	1728	wscript.exe
42	1728	wscript.exe
44	460	wscript.exe
46	1728	wscript.exe
48	1728	wscript.exe
51	1728	wscript.exe
53	1728	wscript.exe

Drops startup file 3 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\receipt#.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qSKbbLcDii.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qSKbbLcDii.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\YSAGQWKNY8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\receipt#.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\qSKbbLcDii.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

804 schtasks.exe

pid	process
804	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1728 wrote to memory of 460	1728	wscript.exe	wscript.exe
PID 1728 wrote to memory of 460	1728	wscript.exe	wscript.exe
PID 1728 wrote to memory of 460	1728	wscript.exe	wscript.exe
PID 1728 wrote to memory of 804	1728	wscript.exe	schtasks.exe
PID 1728 wrote to memory of 804	1728	wscript.exe	schtasks.exe
PID 1728 wrote to memory of 804	1728	wscript.exe	schtasks.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\receipt#.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\qSKbbLcDii.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:460
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\receipt#.js
  2⤵
  - Creates scheduled task(s)
  PID:804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\qSKbbLcDii.js

MD5
b92b39c31fb0838902e1fee6e718174c

SHA1
77fa3f3d9866eb08c5b0a33879e46802de2b7499

SHA256
620b9bbc97663ae23db55e9549ee5a4c4e8098d00a2846191281dfe4b8e4772c

SHA512
c7fa79c9f95bde13e342de4fe6b6e4b9c994e2fc3cf3a8c0e1c12c3ae405a0bb0cd52028c330ac622d8726fffc45b086836e50eab10f5988878fd532083fde05

Download Submit
memory/460-56-0x0000000000000000-mapping.dmp

Download
memory/804-58-0x0000000000000000-mapping.dmp

Download
memory/1728-55-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads