Overview

overview

10

Static

static

eReceipt.js

windows7_x64

10

eReceipt.js

windows10-2004_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    09-07-2022 06:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eReceipt.js

  • Size

    29KB

  • MD5

    f073d180f8bf7dae0dfb837e8d78d82a

  • SHA1

    b7a8e2e4debde8013a9b89e205fc750c85d525d5

  • SHA256

    0a3a6ef611952fbe870b4697a0cb4775a619a4b4599623cf295d6b787d6d43a5

  • SHA512

    3b4d0771f4050f6d7bf14679fde2d8c6278fc5b9def9e5472bc4a066fd26d9be994850874184c03791d1065d0e94ad63e2063ff382c82c496fda51a7bec6f4db

Score
10/10
vjw0rmpersistencetrojanworm

Malware Config

Extracted

Family

vjw0rm

C2

http://zeegod.duckdns.org:9004

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm
  • Blocklisted process makes network request 10 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\eReceipt.js
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\EoqWadtefP.js"
      2⤵
        PID:4652
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\eReceipt.js
        2⤵
        • Creates scheduled task(s)
        PID:4788

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\EoqWadtefP.js
      Filesize

      8KB

      MD5

      a6c14cb2a7afb46ea8b649abc24e83f1

      SHA1

      62bb593672d13446fd62ba53bed45da09cf24bcd

      SHA256

      3c3df3cf093e39d0b670b975c61f8c4be41d7362fa488ad8627b40c09a02d3d0

      SHA512

      bf75ef02d6961c2dcc2eab0ec7a1f545ff9f6e5dde5371b9b603ccd31076b6485b33e87396cd775a79332c09328386dd116b7a892fba5265a5f01a359bd92609

      Download Submit
    • memory/4652-130-0x0000000000000000-mapping.dmp
      Download
    • memory/4788-132-0x0000000000000000-mapping.dmp
      Download