vjw0rm | 4ff9b8de1b21680ca134c0de45071a36fc926d09f3caa2bbcd7e74eb52201862

Analysis

max time kernel
146s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ffe642e037d17d41abf97537d9d44710.js
Size

24KB
MD5

ffe642e037d17d41abf97537d9d44710
SHA1

c612c264a65d6309c91c5837982f2915f6c8a297
SHA256

4ff9b8de1b21680ca134c0de45071a36fc926d09f3caa2bbcd7e74eb52201862
SHA512

4ba4218dc32c89be0b3be8e2525f2f423cadd2d867ccb0185f13fdaf0eb115d0d06eb219ce16f3879036603f2a98d5fd03350459d3eb6e718c271c4b6247c57d
SSDEEP

768:wvEBG2CDUXHoC7ZbsOJFS83VYvIDAvgBSSLtRG:wsBdCyD7ZoOeyqvIDAv/SLu

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 21 IoCs

flow	pid	Process
7	1708	wscript.exe
8	1224	wscript.exe
9	1708	wscript.exe
11	1708	wscript.exe
15	1708	wscript.exe
16	1224	wscript.exe
18	1708	wscript.exe
20	1708	wscript.exe
24	1708	wscript.exe
25	1224	wscript.exe
26	1708	wscript.exe
29	1708	wscript.exe
33	1708	wscript.exe
34	1224	wscript.exe
36	1708	wscript.exe
38	1708	wscript.exe
41	1708	wscript.exe
43	1708	wscript.exe
44	1224	wscript.exe
46	1708	wscript.exe
49	1708	wscript.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ffe642e037d17d41abf97537d9d44710.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ffe642e037d17d41abf97537d9d44710.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MWVEsgEYxm.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MWVEsgEYxm.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\CX2UT40XJ7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ffe642e037d17d41abf97537d9d44710.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1224	1708	wscript.exe	27
PID 1708 wrote to memory of 1224	1708	wscript.exe	27
PID 1708 wrote to memory of 1224	1708	wscript.exe	27

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ffe642e037d17d41abf97537d9d44710.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\MWVEsgEYxm.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MWVEsgEYxm.js

Filesize
8KB

MD5
7a4e51aac8cda40f64a1253cb1d3c306

SHA1
89428a03bccadeb9c0b65c3e5f539532673ad3ec

SHA256
e9bfbc3f5e029a3ce310cc300f57e404d39345dbd79c17a53ea28879b7897c40

SHA512
c930862f146fc41d46cd71dc54ce29399594cd825fcadd53ea3e41a1d005e423a1adc187610b4eb9ab0fb960c79c664d0af6440ca5490ef78f6e2dd663ea775a

Download Submit
memory/1708-54-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

Filesize
8KB

Download