vjw0rm | 355d77dfeedf4cf7d5641618598a55b2571eb227c5f6cbda810acc143c4c2bcc

General

Target

js (2).js
Size

68KB
MD5

c1c77d014849645fd2802f7e4f421bd1
SHA1

0ffe0908f44ba65fa664a1d6a82de61e71690845
SHA256

355d77dfeedf4cf7d5641618598a55b2571eb227c5f6cbda810acc143c4c2bcc
SHA512

f4b107e3123b3f52dbc3dd21c491acb1fc81f366f6ade87f8e1a2aa50695a26b86aa8d1e1c40139f8095577f1b2b211f788f9f9b0d9abf4f7a7ccb1e37df7329
SSDEEP

1536:eET4c9hSc/PbwG+j/UZABcxGI1BG0yz3pLS2Xmi0jd:eEsc9p/DT+kwI1BHw8

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 33 IoCs

Processes:

wscript.exewscript.exewscript.exe

flow	pid	process
4	4228	wscript.exe
5	4440	wscript.exe
7	540	wscript.exe
8	540	wscript.exe
22	540	wscript.exe
26	540	wscript.exe
32	4440	wscript.exe
33	4228	wscript.exe
34	540	wscript.exe
43	540	wscript.exe
47	540	wscript.exe
50	540	wscript.exe
51	4440	wscript.exe
52	4228	wscript.exe
53	540	wscript.exe
54	540	wscript.exe
55	540	wscript.exe
57	540	wscript.exe
58	4440	wscript.exe
59	4228	wscript.exe
60	540	wscript.exe
62	540	wscript.exe
63	540	wscript.exe
64	540	wscript.exe
65	4440	wscript.exe
66	4228	wscript.exe
67	540	wscript.exe
68	540	wscript.exe
69	540	wscript.exe
70	540	wscript.exe
71	4440	wscript.exe
72	4228	wscript.exe
73	540	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

Processes:

wscript.exewscript.exewscript.exewscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\js (2).js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\js (2).js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MdLoMTMthZ.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MdLoMTMthZ.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MdLoMTMthZ.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exewscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\js (2) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\js (2).js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\js (2) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\js (2).js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\js (2) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\js (2).js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\js (2) = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\js (2).js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exewscript.exe

description	pid	process	target process
PID 4980 wrote to memory of 4440	4980	wscript.exe	wscript.exe
PID 4980 wrote to memory of 4440	4980	wscript.exe	wscript.exe
PID 4980 wrote to memory of 540	4980	wscript.exe	wscript.exe
PID 4980 wrote to memory of 540	4980	wscript.exe	wscript.exe
PID 540 wrote to memory of 4228	540	wscript.exe	wscript.exe
PID 540 wrote to memory of 4228	540	wscript.exe	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\js (2).js"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\MdLoMTMthZ.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
PID:4440

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\js (2).js"
2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\MdLoMTMthZ.js"
3⤵
- Blocklisted process makes network request
- Drops startup file
PID:4228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MdLoMTMthZ.js

Filesize
16KB

MD5
2c9dd6febafc1246323d17d70cae26b8

SHA1
8b1b662992584acc1b64ca9626fd272c3f2d49be

SHA256
3a500edcc24ec6e223d86b32f60718e24bd3ee2b186524b627f4fe1783dfb3a5

SHA512
b69df04f7444437ce2835c898d4f1f209cb00184f4e55074e77dc2beaf72bc328ae6cfab25f459e6d7bcea987638dd17301884827d9896bf8ce6692b57ae11e2

Download Submit
C:\Users\Admin\AppData\Roaming\MdLoMTMthZ.js

Filesize
16KB

MD5
2c9dd6febafc1246323d17d70cae26b8

SHA1
8b1b662992584acc1b64ca9626fd272c3f2d49be

SHA256
3a500edcc24ec6e223d86b32f60718e24bd3ee2b186524b627f4fe1783dfb3a5

SHA512
b69df04f7444437ce2835c898d4f1f209cb00184f4e55074e77dc2beaf72bc328ae6cfab25f459e6d7bcea987638dd17301884827d9896bf8ce6692b57ae11e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MdLoMTMthZ.js

Filesize
16KB

MD5
2c9dd6febafc1246323d17d70cae26b8

SHA1
8b1b662992584acc1b64ca9626fd272c3f2d49be

SHA256
3a500edcc24ec6e223d86b32f60718e24bd3ee2b186524b627f4fe1783dfb3a5

SHA512
b69df04f7444437ce2835c898d4f1f209cb00184f4e55074e77dc2beaf72bc328ae6cfab25f459e6d7bcea987638dd17301884827d9896bf8ce6692b57ae11e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\js (2).js

Filesize
68KB

MD5
c1c77d014849645fd2802f7e4f421bd1

SHA1
0ffe0908f44ba65fa664a1d6a82de61e71690845

SHA256
355d77dfeedf4cf7d5641618598a55b2571eb227c5f6cbda810acc143c4c2bcc

SHA512
f4b107e3123b3f52dbc3dd21c491acb1fc81f366f6ade87f8e1a2aa50695a26b86aa8d1e1c40139f8095577f1b2b211f788f9f9b0d9abf4f7a7ccb1e37df7329

Download Submit
C:\Users\Admin\AppData\Roaming\js (2).js

Filesize
68KB

MD5
c1c77d014849645fd2802f7e4f421bd1

SHA1
0ffe0908f44ba65fa664a1d6a82de61e71690845

SHA256
355d77dfeedf4cf7d5641618598a55b2571eb227c5f6cbda810acc143c4c2bcc

SHA512
f4b107e3123b3f52dbc3dd21c491acb1fc81f366f6ade87f8e1a2aa50695a26b86aa8d1e1c40139f8095577f1b2b211f788f9f9b0d9abf4f7a7ccb1e37df7329

Download Submit
memory/540-134-0x0000000000000000-mapping.dmp

Download
memory/4228-136-0x0000000000000000-mapping.dmp

Download
memory/4440-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads