vjw0rm | 860cae2ca6d44d8d9a34df314e7b3f1a64116f2ebe6279ed160fc2f0d7ebea95 | Triage

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
22-06-2022 17:16

Sharing

Report Analysis Logs

General

Target

SYSWOW64.ps1
Size

3KB
MD5

0866c5b72df63add6f9884806682308a
SHA1

6b157db9a413b8e7d7c33b8b4a5713cdbf6f4dea
SHA256

860cae2ca6d44d8d9a34df314e7b3f1a64116f2ebe6279ed160fc2f0d7ebea95
SHA512

bc865a758fa7790e346a7ebb19cd3a3871f7aa16b88b80116bad0846d88104203f81bfd4bf73c46b1d770950c6ff0b48475e313277d51171c42227fe3128b82b

Score

10^/10

vjw0rm trojan worm

Malware Config

Extracted

Family

vjw0rm

C2

http://rick63.publicvm.com:1849

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

7 3156 powershell.exe

Drops startup file 1 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelGraphicsDriverUpdates.vbs	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3156 powershell.exe
3156 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3156 powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\SYSWOW64.ps1
1⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3156-130-0x000001E2369D0000-0x000001E2369F2000-memory.dmp

Filesize
136KB

Download
memory/3156-131-0x00007FFDCFFD0000-0x00007FFDD0A91000-memory.dmp

Filesize
10.8MB

Download
memory/3156-132-0x00007FFDCFFD0000-0x00007FFDD0A91000-memory.dmp

Filesize
10.8MB

Download