vjw0rm | dc53423d89187d301bdadfcab2eadaea50860e6262fa5f3684aec110b1d6c660

General

Target

Documents.js
Size

156KB
MD5

6fef27b2d092e699fe963ced538647d7
SHA1

92f5af7e88153a1cb884a23644366a139ff0941e
SHA256

dc53423d89187d301bdadfcab2eadaea50860e6262fa5f3684aec110b1d6c660
SHA512

022d4d61547b63eff7c6c9400bc965c5f1999475c6a508f6bcbc3aaefb489a55609edabdec243285b904094e9c7ab4d9026dec6897b4bb3268549ce258fa14e2

Score

10^/10

vjw0rm persistence suricata trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata

Blocklisted process makes network request 44 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
1	4404	wscript.exe
3	836	wscript.exe
14	4404	wscript.exe
16	836	wscript.exe
17	4404	wscript.exe
23	4404	wscript.exe
24	836	wscript.exe
25	4404	wscript.exe
27	4404	wscript.exe
32	836	wscript.exe
36	4404	wscript.exe
40	4404	wscript.exe
41	836	wscript.exe
42	4404	wscript.exe
45	836	wscript.exe
46	4404	wscript.exe
47	4404	wscript.exe
48	836	wscript.exe
49	4404	wscript.exe
51	4404	wscript.exe
52	836	wscript.exe
53	4404	wscript.exe
54	4404	wscript.exe
55	836	wscript.exe
56	4404	wscript.exe
57	836	wscript.exe
58	4404	wscript.exe
60	4404	wscript.exe
61	836	wscript.exe
62	4404	wscript.exe
63	4404	wscript.exe
64	836	wscript.exe
66	4404	wscript.exe
67	4404	wscript.exe
68	836	wscript.exe
69	4404	wscript.exe
70	836	wscript.exe
71	4404	wscript.exe
72	4404	wscript.exe
73	836	wscript.exe
74	4404	wscript.exe
75	4404	wscript.exe
76	836	wscript.exe
77	4404	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 4 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\myhwormbin.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\myhwormbin.vbs	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xToCTRaPXT.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xToCTRaPXT.js	wscript.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\myhwormbin = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\myhwormbin.vbs\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\xToCTRaPXT.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\myhwormbin = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\myhwormbin.vbs\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 4696 wrote to memory of 836	4696	wscript.exe	wscript.exe
PID 4696 wrote to memory of 836	4696	wscript.exe	wscript.exe
PID 4696 wrote to memory of 4404	4696	wscript.exe	wscript.exe
PID 4696 wrote to memory of 4404	4696	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Documents.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\xToCTRaPXT.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:836

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\myhwormbin.vbs"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\myhwormbin.vbs

Filesize
13KB

MD5
a8d63ee7c2363269a170a93ec66bcabd

SHA1
d3f10e8119c1e4b481bfcdf47ac78cb062658d1c

SHA256
5355829d1136942095fb27fd990506c6ae00b47eb2e2979af30562979da8b75f

SHA512
f24a609ea53cb3f7c019c1cb197caa8aca2f312bf2e46510ae4b201d4a49797348e1aa8a7b09b4d96f58d6d93ef2e3b136b284b89eb375c1b98b0f929ba17292

Download Submit
C:\Users\Admin\AppData\Roaming\xToCTRaPXT.js

Filesize
47KB

MD5
8ae914d7354bb9f4959138b0839637ba

SHA1
a8a105d4f944f08d2d9ff3286c70f5d822b23ef2

SHA256
baf8ccf5bb9e44dd2f406932e50072f639ea0ae95614f26743e6a8b8d14c66ac

SHA512
e9efdaf109f9cad3c9715e4f44f96f0a09a2d0a1b8d5fc5a836bd31b609fd49389b3a209347690f794065703f0d3be1ad25dc647640af7515852606f555b71e3

Download Submit
memory/836-130-0x0000000000000000-mapping.dmp

Download
memory/4404-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads