vjw0rm | bd589d7e0de188679d2688c2e1f4d43f13ae2239be9603453170daa1b8484951

General

Target

eReceipt.js
Size

578KB
MD5

d64b0399563a39517dbdc2a7b07ebccc
SHA1

bf6b80063cdb8204a491c149ac17a142dcdec2b0
SHA256

bd589d7e0de188679d2688c2e1f4d43f13ae2239be9603453170daa1b8484951
SHA512

36a7a3d56180c7fd883b4c14acfee40c43fd7b962a92c6b837c9d09958f34f16001ce99e4132a886c370beb1ad89d6478625f7b519474dac739ce6463b74b585

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Extracted

Family

vjw0rm

C2

http://kathyaboth.duia.ro:6534

http://zeegod.duckdns.org:9001

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 2 IoCs

Processes:

wscript.exewscript.exe

flow pid process

21 828 wscript.exe
23 3672 wscript.exe

flow	pid	process
21	828	wscript.exe
23	3672	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 4 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AbdlghowYl.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eReceipt.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AbdlghowYl.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LMOXHX511V = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\eReceipt.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\00FAYTSXGU = "\"C:\\Users\\Admin\\AppData\\Roaming\\AbdlghowYl.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 3672 wrote to memory of 828	3672	wscript.exe	wscript.exe
PID 3672 wrote to memory of 828	3672	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\eReceipt.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\AbdlghowYl.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AbdlghowYl.js
MD5
a7efd43f52cb592f4a674e900cafe0f9

SHA1
69b512179460e51463d4cadc75838cbbdfd59b95

SHA256
b670690136c73f206b2c8a3207a41c626f548a787ba3378b78b1e098c984a0cc

SHA512
601ceb0f725bb2db320880523b25c249fbf52d56162bff6496792405493d7adad2119f1dca18868be3539e72ec62c1b0906d5a9ccae9aa72809b288d0a3b108c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads