vjw0rm | 365fb34e5d2f5f4a143599765d0ac0f34dc1b6cddf857c6cf8f87f17d7408f1b

General

Target

New-Order.js
Size

90KB
MD5

887c83e306335e36f6e81cdd30f527e2
SHA1

3ec7601bb106ba9bb4639e75b9466adaf52e5607
SHA256

365fb34e5d2f5f4a143599765d0ac0f34dc1b6cddf857c6cf8f87f17d7408f1b
SHA512

3dddd2b196538e2c684435e7f451b236c21b4e042716d4dc6cc791b64d77fd7395b11a4f45a69203e31f95b6f5e32bd86d8e533b66b2eed86e12e89b4907a814

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 38 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
5	4496	wscript.exe
6	1356	wscript.exe
11	4496	wscript.exe
12	1356	wscript.exe
14	4496	wscript.exe
20	1356	wscript.exe
21	4496	wscript.exe
27	1356	wscript.exe
32	4496	wscript.exe
35	4496	wscript.exe
36	1356	wscript.exe
40	4496	wscript.exe
41	1356	wscript.exe
50	4496	wscript.exe
53	1356	wscript.exe
55	4496	wscript.exe
58	1356	wscript.exe
59	4496	wscript.exe
60	4496	wscript.exe
61	1356	wscript.exe
62	4496	wscript.exe
63	1356	wscript.exe
66	4496	wscript.exe
67	1356	wscript.exe
68	4496	wscript.exe
69	1356	wscript.exe
70	4496	wscript.exe
71	4496	wscript.exe
72	1356	wscript.exe
73	4496	wscript.exe
74	1356	wscript.exe
75	4496	wscript.exe
76	1356	wscript.exe
77	4496	wscript.exe
78	1356	wscript.exe
79	4496	wscript.exe
80	4496	wscript.exe
81	1356	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 4 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kay.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kay.vbs	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvvsJzsPhE.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvvsJzsPhE.js	wscript.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\cvvsJzsPhE.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kay = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\kay.vbs\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kay = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\kay.vbs\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 940 wrote to memory of 1356	940	wscript.exe	wscript.exe
PID 940 wrote to memory of 1356	940	wscript.exe	wscript.exe
PID 940 wrote to memory of 4496	940	wscript.exe	wscript.exe
PID 940 wrote to memory of 4496	940	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\New-Order.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\cvvsJzsPhE.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1356

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\kay.vbs"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kay.vbs
Filesize
13KB

MD5
176af413683987deea53dbad395c8027

SHA1
f3b812fb7332428198a741ab6dd87512de3d90b7

SHA256
54c8679f246a73a270a028047bd7a6e99ef4b8ca4c1fedaa3ef8f721c374ae8b

SHA512
99afe74936a00618b1380c7ee0a64c31adf8948286576c0c14f6c63d00ca9160d66c95b5a2fe99855d6bbf03412180e0f01e9e817caa24f74449dad513808dd9

Download Submit
C:\Users\Admin\AppData\Roaming\cvvsJzsPhE.js
Filesize
24KB

MD5
169755648aaba2c23fb1b231a712c8a1

SHA1
31cfa09f2acd9b2df004f6934ffcd5bc8919d5b6

SHA256
9610c1b7745f4e5ba3f0034cf634ee5b00ea01a9dcaecc23853ed064296d1eda

SHA512
08c4aa0a41c50673ceeaf7f47b6c0615421e275907551841d229818d6d40d3a15eab2be21da602036ad34ebd8a7adec968fb41c0cd2fe5c5dfe5e7b9f4330c11

Download Submit
memory/1356-130-0x0000000000000000-mapping.dmp

Download
memory/4496-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads