vjw0rm | 9060f5e5675f06ff2744114c852ada2f5b146144cec99457f7435c529426fa81

General

Target

PO N°CF004303.js
Size

45KB
MD5

fb075b3dbae613fee795bef80bf3eebc
SHA1

f9156e2680111c34a5a56cc3fb36d86742db6ff8
SHA256

9060f5e5675f06ff2744114c852ada2f5b146144cec99457f7435c529426fa81
SHA512

2e0a57c232afd7516fe98a2a27eae9d8dd97097a9f580a742faa6979a9ab492ef3c1d55de7fb429854482447f7ada6c61a9de171747a4152196aaf711ecabe9c
SSDEEP

768:NZLXAlESuz9e/oRmQSL0UvOcVzNf37JxEJNvsgiyYO1x:4iS9/wmQSLQWfX+UAYOH

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 16 IoCs

Processes:

wscript.exewscript.exewscript.exe

flow	pid	process
29	3996	wscript.exe
30	1080	wscript.exe
31	636	wscript.exe
50	636	wscript.exe
64	1080	wscript.exe
65	3996	wscript.exe
79	636	wscript.exe
85	1080	wscript.exe
86	3996	wscript.exe
95	636	wscript.exe
96	3996	wscript.exe
97	1080	wscript.exe
102	636	wscript.exe
104	1080	wscript.exe
106	3996	wscript.exe
109	636	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

Processes:

wscript.exewscript.exewscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO N°CF004303.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KGRPDFvesU.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KGRPDFvesU.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO N°CF004303.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KGRPDFvesU.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO N°CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO N°CF004303.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO N°CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO N°CF004303.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO N°CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO N°CF004303.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO N°CF004303 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\PO N°CF004303.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exewscript.exe

description	pid	process	target process
PID 3636 wrote to memory of 3996	3636	wscript.exe	wscript.exe
PID 3636 wrote to memory of 3996	3636	wscript.exe	wscript.exe
PID 3636 wrote to memory of 636	3636	wscript.exe	wscript.exe
PID 3636 wrote to memory of 636	3636	wscript.exe	wscript.exe
PID 636 wrote to memory of 1080	636	wscript.exe	wscript.exe
PID 636 wrote to memory of 1080	636	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO N°CF004303.js"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3636

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\KGRPDFvesU.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
PID:3996

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\PO N°CF004303.js"
2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\KGRPDFvesU.js"
3⤵
- Blocklisted process makes network request
- Drops startup file
PID:1080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\KGRPDFvesU.js

Filesize
8KB

MD5
01e46cde81ecddd417528e53a84cf2aa

SHA1
2ca646a2935daec82d4e1a06d4d2136fcd3e9ab5

SHA256
020733714168e60e4d9292e37f34f7c08b7acb77632579d269ce7d623e955c3c

SHA512
187e1bfea8fbf667e4182e0ad055f1f524f419de12ca7ad4cb21cdcde0e8fc93482ccbb5dc09c6896b164a9615cec43827319a2842b2463868a8ff13946abb92

Download Submit
C:\Users\Admin\AppData\Roaming\KGRPDFvesU.js

Filesize
8KB

MD5
01e46cde81ecddd417528e53a84cf2aa

SHA1
2ca646a2935daec82d4e1a06d4d2136fcd3e9ab5

SHA256
020733714168e60e4d9292e37f34f7c08b7acb77632579d269ce7d623e955c3c

SHA512
187e1bfea8fbf667e4182e0ad055f1f524f419de12ca7ad4cb21cdcde0e8fc93482ccbb5dc09c6896b164a9615cec43827319a2842b2463868a8ff13946abb92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KGRPDFvesU.js

Filesize
8KB

MD5
01e46cde81ecddd417528e53a84cf2aa

SHA1
2ca646a2935daec82d4e1a06d4d2136fcd3e9ab5

SHA256
020733714168e60e4d9292e37f34f7c08b7acb77632579d269ce7d623e955c3c

SHA512
187e1bfea8fbf667e4182e0ad055f1f524f419de12ca7ad4cb21cdcde0e8fc93482ccbb5dc09c6896b164a9615cec43827319a2842b2463868a8ff13946abb92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO N°CF004303.js

Filesize
45KB

MD5
8d2c0f19aadc3185c965641bda720ff0

SHA1
4b53f247d5e49c1c2ef227dd4dec8ffe6796ffa6

SHA256
c8c879abecee4055bdfd555c038d2957aeb2e0fe63441bdfc794feb522398cfb

SHA512
b4a1e9357ccdbc585badaf5486bf8b5af1e722b05f10ec2dcbb905669914200bdd618c9e804e789484c3e7ac2ac3b9ebcbf22b49daed43ae0a069aab87b63102

Download Submit
C:\Users\Admin\AppData\Roaming\PO N°CF004303.js

Filesize
45KB

MD5
fb075b3dbae613fee795bef80bf3eebc

SHA1
f9156e2680111c34a5a56cc3fb36d86742db6ff8

SHA256
9060f5e5675f06ff2744114c852ada2f5b146144cec99457f7435c529426fa81

SHA512
2e0a57c232afd7516fe98a2a27eae9d8dd97097a9f580a742faa6979a9ab492ef3c1d55de7fb429854482447f7ada6c61a9de171747a4152196aaf711ecabe9c

Download Submit
memory/636-134-0x0000000000000000-mapping.dmp

Download
memory/1080-136-0x0000000000000000-mapping.dmp

Download
memory/3996-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads