vjw0rm | c673548131b745edf8a8ec0737790633ec0a44aef9771ac4d4ff301fd915d2e0

General

Target

New Order.js
Size

102KB
MD5

f890e7d367f88ec86a590713f93891b5
SHA1

a179e35efd7a8fa0eb5216b4d3e65e8e8935493c
SHA256

c673548131b745edf8a8ec0737790633ec0a44aef9771ac4d4ff301fd915d2e0
SHA512

63a9adb256314a0acc4f8491dcb6b7e4471ecdfcfc9e40a659689d5f836d2807275de15e9d44823c67a662d421a783d58f6addcef44231aa7ac029b0e450ba22

Score

10^/10

vjw0rm persistence suricata trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
suricata
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1
suricata

Blocklisted process makes network request 35 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
6	1164	wscript.exe
7	3556	wscript.exe
9	1164	wscript.exe
10	3556	wscript.exe
11	1164	wscript.exe
12	1164	wscript.exe
13	3556	wscript.exe
14	1164	wscript.exe
16	1164	wscript.exe
19	3556	wscript.exe
26	1164	wscript.exe
28	1164	wscript.exe
29	3556	wscript.exe
35	1164	wscript.exe
40	1164	wscript.exe
43	1164	wscript.exe
45	3556	wscript.exe
47	1164	wscript.exe
48	3556	wscript.exe
50	1164	wscript.exe
51	3556	wscript.exe
58	1164	wscript.exe
61	3556	wscript.exe
65	1164	wscript.exe
69	1164	wscript.exe
70	3556	wscript.exe
83	1164	wscript.exe
84	3556	wscript.exe
86	1164	wscript.exe
87	3556	wscript.exe
88	1164	wscript.exe
98	3556	wscript.exe
101	1164	wscript.exe
119	3556	wscript.exe
120	1164	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 4 IoCs

Processes:

wscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qwbDCtDwoT.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qwbDCtDwoT.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\banga.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\banga.vbs	wscript.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\qwbDCtDwoT.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\banga = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\banga.vbs\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\banga = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\banga.vbs\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 2272 wrote to memory of 3556	2272	wscript.exe	wscript.exe
PID 2272 wrote to memory of 3556	2272	wscript.exe	wscript.exe
PID 2272 wrote to memory of 1164	2272	wscript.exe	wscript.exe
PID 2272 wrote to memory of 1164	2272	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\New Order.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\qwbDCtDwoT.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:3556

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\banga.vbs"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\banga.vbs
Filesize
13KB

MD5
176af413683987deea53dbad395c8027

SHA1
f3b812fb7332428198a741ab6dd87512de3d90b7

SHA256
54c8679f246a73a270a028047bd7a6e99ef4b8ca4c1fedaa3ef8f721c374ae8b

SHA512
99afe74936a00618b1380c7ee0a64c31adf8948286576c0c14f6c63d00ca9160d66c95b5a2fe99855d6bbf03412180e0f01e9e817caa24f74449dad513808dd9

Download Submit
C:\Users\Admin\AppData\Roaming\qwbDCtDwoT.js
Filesize
28KB

MD5
02dfcde710c26f469f0b5d931926840e

SHA1
5985779d32ee71ea07cb6e8f14767f1238fab1bb

SHA256
59a6cd007dc4f1ab77cfb404ac08e54ed63b29e442ba5842db00daf4a0fee890

SHA512
d8d25488e63e9333de10e8a90d232eba656a47d2bdb7e20c4ceee995e6e24b3834774e4e76bf2d90752191ed466d1b3eb6fd4e593610f502f37d2664abe66553

Download Submit
memory/1164-131-0x0000000000000000-mapping.dmp

Download
memory/3556-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads