vjw0rm | 55816e1bfc1ecacaf3b11ba133675b6ffbef0d4b41f9c27e18aa0aca8021ea05

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2022, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New PO 2235788.js
Size 24KB
Sample220929-te2pwabch8
SHA256 55816e1bfc1ecacaf3b11ba133675b6ffbef0d4b41f9c27e18aa0aca8021ea05
MD5 cc4a0c95160fb7bb0b26669219ec3cbe
SHA1 a8f14e9b82a42ad7d7d91d1b0f568a1c02dd7296
SHA512 51666ca537d8c08f852fd253b294bb9afb6931ef939aead299bdcc3a6f534768ce4a090731a7314c1c42e07011e0beda35994551816328c49fb40b2af91e2487
SSDEEP 384:834sBkYlTBU2EOD5iQZtlog7zxadFK5w5Ss3d5LDsnRvFxbn+t9ALB/hJkkMHbGC:DWVU29D5XVog7zxaTYiS83wBgBSSLtyG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vjw0rm trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 20 IoCs

flow	pid	Process
6	3768	wscript.exe
7	2564	wscript.exe
12	2564	wscript.exe
18	2564	wscript.exe
25	3768	wscript.exe
28	2564	wscript.exe
34	2564	wscript.exe
45	3768	wscript.exe
48	2564	wscript.exe
49	2564	wscript.exe
50	3768	wscript.exe
51	2564	wscript.exe
53	2564	wscript.exe
54	2564	wscript.exe
55	3768	wscript.exe
56	2564	wscript.exe
57	2564	wscript.exe
58	2564	wscript.exe
59	3768	wscript.exe
60	2564	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New PO 2235788.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New PO 2235788.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\otrgyNTPtH.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\otrgyNTPtH.js	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 3768	2564	wscript.exe	79
PID 2564 wrote to memory of 3768	2564	wscript.exe	79

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\New PO 2235788.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\otrgyNTPtH.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:3768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

otrgyNTPtH.js

Path C:\Users\Admin\AppData\Roaming\otrgyNTPtH.js
Size 8KB
SHA256 054ad841c2165a57ca58e5d1eff2279f783961a0d82f7c3ae0977b68d1a291db
MD5 6530b3eff309aa753490b88170af519a
SHA1 5f801d45f06ce84f20c01facbb7a0891d4852498
SHA512 1f0bd6b746678b9e43944212d7ca56adb0983256f6f5342c7f5b29f7fcc8e9019b9455036fac9c753a5ae5b96f573538d888ca98255f2e7a5fecb6549651f523
SSDEEP 192:ynNpa30LVoRJE3ULyvtrhbRsRqIswRkMHB5GSvIxoGK3N4tNG:8N0AeJLyvtrlSBjkMHbGSLtWtNG
MD5 SHA1 SHA512 SSDEEP

Submit Download