vjw0rm | 48ef19b9669fe0fa15daa9a81eab58f28ea9c4a4d01c502422bf71e7a882eaee

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2022, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL_INVOICE DOCUMENTS.pdf.js
Size

39KB
MD5

728ad59ffec76f58dce2aa113c5c42c3
SHA1

fede8848c27498a5a0d5f3738410aa996271654e
SHA256

48ef19b9669fe0fa15daa9a81eab58f28ea9c4a4d01c502422bf71e7a882eaee
SHA512

f3a3ede48e4e1c4ece4381e66950b3e713dc4a484ecb195feaf860c24d4169fe7d635d34a9ec4c707f8339e288b047eeb8807ad8aa125c4f26ccb385b633de43
SSDEEP

768:sjLTSr8U0fXfpYiLnkSl5hjs/2JqmT9Kj+VcegMsx1ict:SrUMY+9l5hjs/2JqmT9KS2jx4ct

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 53 IoCs

flow	pid	Process
4	4848	wscript.exe
5	2148	wscript.exe
7	1256	wscript.exe
15	1256	wscript.exe
16	4848	wscript.exe
17	2148	wscript.exe
23	1256	wscript.exe
24	4848	wscript.exe
25	2148	wscript.exe
26	1256	wscript.exe
28	4848	wscript.exe
29	2148	wscript.exe
31	1256	wscript.exe
42	1256	wscript.exe
43	4848	wscript.exe
44	2148	wscript.exe
46	1256	wscript.exe
47	4848	wscript.exe
48	2148	wscript.exe
52	1256	wscript.exe
55	4848	wscript.exe
56	2148	wscript.exe
57	1256	wscript.exe
59	1256	wscript.exe
60	4848	wscript.exe
61	2148	wscript.exe
62	1256	wscript.exe
63	4848	wscript.exe
64	2148	wscript.exe
65	1256	wscript.exe
66	4848	wscript.exe
67	2148	wscript.exe
68	1256	wscript.exe
70	1256	wscript.exe
71	4848	wscript.exe
72	2148	wscript.exe
73	1256	wscript.exe
74	4848	wscript.exe
75	2148	wscript.exe
76	1256	wscript.exe
77	4848	wscript.exe
78	2148	wscript.exe
79	1256	wscript.exe
80	1256	wscript.exe
81	4848	wscript.exe
82	2148	wscript.exe
83	1256	wscript.exe
84	4848	wscript.exe
85	2148	wscript.exe
86	1256	wscript.exe
87	4848	wscript.exe
88	2148	wscript.exe
89	1256	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL_INVOICE DOCUMENTS.pdf.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BxhYPNKBAd.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BxhYPNKBAd.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL_INVOICE DOCUMENTS.pdf.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BxhYPNKBAd.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DHL_INVOICE DOCUMENTS = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\DHL_INVOICE DOCUMENTS.pdf.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DHL_INVOICE DOCUMENTS = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\DHL_INVOICE DOCUMENTS.pdf.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DHL_INVOICE DOCUMENTS = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\DHL_INVOICE DOCUMENTS.pdf.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DHL_INVOICE DOCUMENTS = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\DHL_INVOICE DOCUMENTS.pdf.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\software\microsoft\windows\currentversion\run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4848	4872	wscript.exe	79
PID 4872 wrote to memory of 4848	4872	wscript.exe	79
PID 4872 wrote to memory of 1256	4872	wscript.exe	80
PID 4872 wrote to memory of 1256	4872	wscript.exe	80
PID 1256 wrote to memory of 2148	1256	wscript.exe	81
PID 1256 wrote to memory of 2148	1256	wscript.exe	81

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\DHL_INVOICE DOCUMENTS.pdf.js"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BxhYPNKBAd.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:4848
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\DHL_INVOICE DOCUMENTS.pdf.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BxhYPNKBAd.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BxhYPNKBAd.js

Filesize
5KB

MD5
9bafee3b0e757f243611934bc1ec4900

SHA1
27d6130c2ced08d822f991c9ed74bbd5be2383d7

SHA256
d3d699118324ebd6717208f941b1086fb3f5f5b0415cb827dcbc6e1be172eb90

SHA512
3a43818f3688906fa3c83790a08b89dd1c571b8130a40008e27d503d43faa730deb5955ea36eb97086511cdd759fed2e46f3b22ad1985f0421ee77f09da63b51

Download Submit
C:\Users\Admin\AppData\Roaming\BxhYPNKBAd.js

Filesize
5KB

MD5
9bafee3b0e757f243611934bc1ec4900

SHA1
27d6130c2ced08d822f991c9ed74bbd5be2383d7

SHA256
d3d699118324ebd6717208f941b1086fb3f5f5b0415cb827dcbc6e1be172eb90

SHA512
3a43818f3688906fa3c83790a08b89dd1c571b8130a40008e27d503d43faa730deb5955ea36eb97086511cdd759fed2e46f3b22ad1985f0421ee77f09da63b51

Download Submit
C:\Users\Admin\AppData\Roaming\DHL_INVOICE DOCUMENTS.pdf.js

Filesize
39KB

MD5
728ad59ffec76f58dce2aa113c5c42c3

SHA1
fede8848c27498a5a0d5f3738410aa996271654e

SHA256
48ef19b9669fe0fa15daa9a81eab58f28ea9c4a4d01c502422bf71e7a882eaee

SHA512
f3a3ede48e4e1c4ece4381e66950b3e713dc4a484ecb195feaf860c24d4169fe7d635d34a9ec4c707f8339e288b047eeb8807ad8aa125c4f26ccb385b633de43

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BxhYPNKBAd.js

Filesize
5KB

MD5
9bafee3b0e757f243611934bc1ec4900

SHA1
27d6130c2ced08d822f991c9ed74bbd5be2383d7

SHA256
d3d699118324ebd6717208f941b1086fb3f5f5b0415cb827dcbc6e1be172eb90

SHA512
3a43818f3688906fa3c83790a08b89dd1c571b8130a40008e27d503d43faa730deb5955ea36eb97086511cdd759fed2e46f3b22ad1985f0421ee77f09da63b51

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHL_INVOICE DOCUMENTS.pdf.js

Filesize
39KB

MD5
728ad59ffec76f58dce2aa113c5c42c3

SHA1
fede8848c27498a5a0d5f3738410aa996271654e

SHA256
48ef19b9669fe0fa15daa9a81eab58f28ea9c4a4d01c502422bf71e7a882eaee

SHA512
f3a3ede48e4e1c4ece4381e66950b3e713dc4a484ecb195feaf860c24d4169fe7d635d34a9ec4c707f8339e288b047eeb8807ad8aa125c4f26ccb385b633de43

Download Submit