vjw0rm | 04a29f2129342754634281d655ea4d01ee9197fdb25698a3683bf724e95af3e2

General

Target

eVoucher.js
Size

15KB
MD5

b4d2f443f05f58a96cb91b6d49f3a94e
SHA1

f91885a8a8c5acb059a33a9a2f6b137aafac117c
SHA256

04a29f2129342754634281d655ea4d01ee9197fdb25698a3683bf724e95af3e2
SHA512

b0192fee21a531e162175e2a89624a85cf5e0e10e5c8e4e982ae4a0dda43c78cbeac5cecdc5de90cb1902ddd66053cfcb4f8c230c0759148c4779f3d6b891a6a

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 9 IoCs

Processes:

wscript.exewscript.exe

flow	pid	process
5	908	wscript.exe
8	1312	wscript.exe
10	908	wscript.exe
11	908	wscript.exe
12	908	wscript.exe
16	1312	wscript.exe
19	1312	wscript.exe
23	1312	wscript.exe
25	1312	wscript.exe

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

icekid.exe

pid process

2032 icekid.exe

pid	process
2032	icekid.exe

Drops startup file 3 IoCs

Processes:

wscript.exeicekid.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UBkYyCfiCr.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UBkYyCfiCr.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ICE X.exe	icekid.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

icekid.exewscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ICE X = "\"C:\\Users\\Admin\\AppData\\Roaming\\ICE X.exe\""	icekid.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	icekid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ICE X = "\"C:\\Users\\Admin\\AppData\\Roaming\\ICE X.exe\""	icekid.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\UBkYyCfiCr.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	icekid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1004 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1004 powershell.exe

pid	process
1004	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1004	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

wscript.exeicekid.execmd.exe

description	pid	process	target process
PID 908 wrote to memory of 1312	908	wscript.exe	wscript.exe
PID 908 wrote to memory of 1312	908	wscript.exe	wscript.exe
PID 908 wrote to memory of 1312	908	wscript.exe	wscript.exe
PID 908 wrote to memory of 2032	908	wscript.exe	icekid.exe
PID 908 wrote to memory of 2032	908	wscript.exe	icekid.exe
PID 908 wrote to memory of 2032	908	wscript.exe	icekid.exe
PID 908 wrote to memory of 2032	908	wscript.exe	icekid.exe
PID 2032 wrote to memory of 1348	2032	icekid.exe	cmd.exe
PID 2032 wrote to memory of 1348	2032	icekid.exe	cmd.exe
PID 2032 wrote to memory of 1348	2032	icekid.exe	cmd.exe
PID 2032 wrote to memory of 1348	2032	icekid.exe	cmd.exe
PID 1348 wrote to memory of 1004	1348	cmd.exe	powershell.exe
PID 1348 wrote to memory of 1004	1348	cmd.exe	powershell.exe
PID 1348 wrote to memory of 1004	1348	cmd.exe	powershell.exe
PID 1348 wrote to memory of 1004	1348	cmd.exe	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\eVoucher.js
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\UBkYyCfiCr.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1312

C:\Users\Admin\AppData\Roaming\icekid.exe
"C:\Users\Admin\AppData\Roaming\icekid.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\file.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\file.bat
Filesize
239B

MD5
f6e9a890d89cbc6684cc81fdba858cb4

SHA1
352924f71a6debb722a31af9d9a2c9bc157f6593

SHA256
7300f298f3baf29ec7dfcffb6ed84a14eea910dd323d845f9c343990b8754c51

SHA512
e0ddd4bdc29b355937be75ea90b1c8a0b4e9ce631364fcc35635a7f33b7e00a4a245402456cf17364a91a61cf1a551f2fb49d3f25133a4e488a5f379014264d9

Download Submit
C:\Users\Admin\AppData\Roaming\UBkYyCfiCr.js
Filesize
6KB

MD5
82d8d55e742ea8bea7158934a3fb461a

SHA1
45121cc1d48fab1b0d51dc44bde0797b85a083ce

SHA256
e997d4606b047f6df4b5700761ce282ab321a14ce8235eae195e3f6c8dec21e4

SHA512
988b2272538a3a61578d49cfc2f1b5d79a98557c469ac6ce4a02e1ae1f985d5235d6236efa593efa8841b58723c6dd8c6525e7865b1c93685d460e017042c121

Download Submit
C:\Users\Admin\AppData\Roaming\icekid.exe
Filesize
347KB

MD5
d2c56c415bfce587d346ba4b1858445a

SHA1
837d56d2724a7734ab8ceff4f85f45387eca7741

SHA256
18a815716147275786420495730409e4b54cea2a008db99d840a4adcc019dabe

SHA512
1ed0f830e0d6fa20f957a12121e9056569017555a97553f2944efdd8a777746a15508ac1c656025fae13ae05d3ae48ae533974a38db6b77a4de70544d62bc150

Download Submit
C:\Users\Admin\AppData\Roaming\icekid.exe
Filesize
347KB

MD5
d2c56c415bfce587d346ba4b1858445a

SHA1
837d56d2724a7734ab8ceff4f85f45387eca7741

SHA256
18a815716147275786420495730409e4b54cea2a008db99d840a4adcc019dabe

SHA512
1ed0f830e0d6fa20f957a12121e9056569017555a97553f2944efdd8a777746a15508ac1c656025fae13ae05d3ae48ae533974a38db6b77a4de70544d62bc150

Download Submit
memory/908-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download
memory/1004-64-0x0000000000000000-mapping.dmp

Download
memory/1004-66-0x0000000073F90000-0x000000007453B000-memory.dmp

Filesize
5.7MB

Download
memory/1004-67-0x0000000073F90000-0x000000007453B000-memory.dmp

Filesize
5.7MB

Download
memory/1312-55-0x0000000000000000-mapping.dmp

Download
memory/1348-62-0x0000000000000000-mapping.dmp

Download
memory/2032-58-0x0000000000000000-mapping.dmp

Download
memory/2032-60-0x0000000075CD1000-0x0000000075CD3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads