vjw0rm | 56996c6145346114bcefd9028fa95a8232d1ce0e380e216a06975d7cad14c649

General

Target

Order Receipt UPS1605-192-DD-22.js
Size

20KB
MD5

8d2786e0a6c850c170c679a54e0d5f20
SHA1

0fd46e20522fd76ea36953c971fe93c8b03f7a23
SHA256

56996c6145346114bcefd9028fa95a8232d1ce0e380e216a06975d7cad14c649
SHA512

10370279326a30c41dc49f58884734ee3c56d7c99441f123bb42bb0949d0b966b73ec18ddc7aba71b62b2bb5428bb2ddb4e645c05fb2350d0b2cae738a90d2ec

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Extracted

Family

vjw0rm

C2

http://shizzlegateway.duckdns.org:1605

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 17 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
8	572	wscript.exe
9	1396	wscript.exe
10	572	wscript.exe
12	572	wscript.exe
15	572	wscript.exe
17	572	wscript.exe
18	572	wscript.exe
21	572	wscript.exe
23	572	wscript.exe
25	572	wscript.exe
27	572	wscript.exe
29	572	wscript.exe
31	572	wscript.exe
34	572	wscript.exe
36	572	wscript.exe
37	572	wscript.exe
40	572	wscript.exe

Drops startup file 3 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Order Receipt UPS1605-192-DD-22.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\euzvArPgoF.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\euzvArPgoF.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\euzvArPgoF.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\34AXX2OH7H = "\"C:\\Users\\Admin\\AppData\\Roaming\\Order Receipt UPS1605-192-DD-22.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1396 wrote to memory of 572	1396	wscript.exe	wscript.exe
PID 1396 wrote to memory of 572	1396	wscript.exe	wscript.exe
PID 1396 wrote to memory of 572	1396	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Order Receipt UPS1605-192-DD-22.js"
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\euzvArPgoF.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\euzvArPgoF.js

MD5
67169d1ab2dfb5a49bcc1479af675084

SHA1
069864adaa1f4a8348b7932a8f015d95a9767d2e

SHA256
6d56ae4f6e2f11e03334d9c649a4f9af6c00d59ba59bc4d29a55477309bf14a1

SHA512
f45c34a8de1127d9fbde553c33b9e2ac394d7713b99f2df4d55b1e8c130eb21e498f0191c7345c56fcb151e0a52dc90249a3c6ecc2440f0d203f87a984c26586

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads