vjw0rm | 12ca249e9fa5ed956d072ec466416fe50cf35c4c6c481ce19e07a52ef31e1a8a

General

Target

????????? ?? ?????? Ref. No. MS-DGP-220137.js
Size

375KB
MD5

b34c9083eed5a3f38346fa1bf618745e
SHA1

bdd94f1f3509a6507b280d06a240c2df1c5a37e6
SHA256

12ca249e9fa5ed956d072ec466416fe50cf35c4c6c481ce19e07a52ef31e1a8a
SHA512

347bebc6d34a940423af01ac145c6e78555ba606a80af66973bf9ab9f73f23760fc0e27569ae15df7c5f3e53cc14f8889a00d38860f3255ca0868c8196f6763b

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 2 IoCs

Processes:

wscript.exe

flow pid process

12 4452 wscript.exe
20 4452 wscript.exe

flow	pid	process
12	4452	wscript.exe
20	4452	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BCSDWooOYA.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BCSDWooOYA.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\BCSDWooOYA.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1808 wrote to memory of 4452	1808	wscript.exe	wscript.exe
PID 1808 wrote to memory of 4452	1808	wscript.exe	wscript.exe
PID 1808 wrote to memory of 2788	1808	wscript.exe	java.exe
PID 1808 wrote to memory of 2788	1808	wscript.exe	java.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\_________ __ ______ Ref. No. MS-DGP-220137.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BCSDWooOYA.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4452

C:\Program Files\Java\jre1.8.0_66\bin\java.exe
"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Local\Temp\SM.jar"
2⤵
PID:2788

C:\Program Files\Java\jre1.8.0_66\bin\java.exe
"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\SM.jar"
3⤵
PID:4492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SM.jar
Filesize
164KB

MD5
edf0e95033cb0df96be06c5088142288

SHA1
3972af92633203e7857ec0e4ae65246b32c83539

SHA256
9712cb8921bc1aaf24f86d6a82ce59a332f6ad04eb1af0414f9bd51e0f35e049

SHA512
b7086f0880328bfbb11f6a48a95bde9718318bec9a66c4d00dc16384a1c7ccae97685c7e50d8278c3a267431032d418c61acc9a9ca926d0bd948b79c722a562a

Download Submit
C:\Users\Admin\AppData\Roaming\BCSDWooOYA.js
Filesize
30KB

MD5
f95e2fe23993c064a1ebe6ae37151557

SHA1
56bd821e2fdb2b1f29e87ed82a1f35832501a166

SHA256
a0067ec481aa5a688c7f3db9d48a4a6eea6b1b801edb53a6d820133f10201d78

SHA512
423de8b117a99f7e23f9423760d7c96b28fcde2bcdca3d4da2b114c1a3b4d2d3b96dae0a643c364d014082d1900ca1657aaaf6814e0a986fcc8f9abb721acd37

Download Submit
memory/2788-132-0x0000000000000000-mapping.dmp

Download
memory/2788-138-0x00000000025F0000-0x00000000035F0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-151-0x00000000025F0000-0x00000000035F0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-153-0x00000000025F0000-0x00000000035F0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-155-0x00000000025F0000-0x00000000035F0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-165-0x00000000025F0000-0x00000000035F0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-173-0x00000000025F0000-0x00000000035F0000-memory.dmp

Filesize
16.0MB

Download
memory/4452-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads