vjw0rm | 6a9ee5e98addffa7e54b116cedc1b6794729ff069b2b9544082951550b10a2e4

Analysis

Target

Voicemail-Audio092_MP3.js
Size

11KB
MD5

b50f717518a0939ac7e44a7dd6afc4e8
SHA1

ce751d94536e4407b83adf761e782a071bfdef83
SHA256

4af88399a03ea0efe67abdd65989faacb978f8aac7e42a56e22e0d0d546be937
SHA512

059bf5caeb19a111edb50ee421ad1d573d366badb1970c4cca8f665309c98ee74398cd5d7810b1d01fd4b0c837510d8c405c1cf4fc1a8706915380837a1f3319

Score

10^/10

Family

vjw0rm

http://hwprocessing.duckdns.org:9933

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow pid process

6 4248 wscript.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation wscript.exe

flow	pid	process
6	4248	wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Voicemail-Audio092_MP3.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Voicemail-Audio092_MP3.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8Z0TNMFXTR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Voicemail-Audio092_MP3.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

5068 schtasks.exe

pid	process
5068	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 4248 wrote to memory of 5068	4248	wscript.exe	schtasks.exe
PID 4248 wrote to memory of 5068	4248	wscript.exe	schtasks.exe

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\Voicemail-Audio092_MP3.js
2⤵
- Creates scheduled task(s)
PID:5068