vjw0rm | 09b361c61bcd3e3c9a8eda0a5260d953dd3bd749dd6d037d26cdfec0474a972e

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2022, 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aa5dd5a8392d399292fd831f9ebc486.js
Size

48KB
MD5

8aa5dd5a8392d399292fd831f9ebc486
SHA1

b7815f4df84394870dd7ca91c731fe606f726afd
SHA256

754416cc0f441aef7bacb842368fd06744048c4219943d5bd093e2a7e17f9267
SHA512

82b1f15b16f4f73947165084ecdcf9ef28ec02f29ceb86eb1ba831c9b2d561d72c311965532a363bd03cbcca0f8497acf8e9a3672c29a86cfe71ef1aa4e4e78a
SSDEEP

768:9ELx847vqNaCQVUmobI2iSi5B7sqkl3enKxNH7sse:W4Q8xsB7sqkW8NHI5

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 53 IoCs

flow	pid	Process
7	3356	wscript.exe
8	3976	wscript.exe
9	552	wscript.exe
15	3356	wscript.exe
16	552	wscript.exe
17	3976	wscript.exe
18	3356	wscript.exe
19	552	wscript.exe
20	3976	wscript.exe
21	3356	wscript.exe
35	3976	wscript.exe
36	552	wscript.exe
38	3356	wscript.exe
55	3356	wscript.exe
61	552	wscript.exe
62	3976	wscript.exe
64	3356	wscript.exe
65	3976	wscript.exe
66	552	wscript.exe
69	3356	wscript.exe
73	3976	wscript.exe
74	552	wscript.exe
75	3356	wscript.exe
80	3356	wscript.exe
81	3976	wscript.exe
82	552	wscript.exe
83	3356	wscript.exe
90	3976	wscript.exe
91	552	wscript.exe
92	3356	wscript.exe
93	3976	wscript.exe
94	552	wscript.exe
95	3356	wscript.exe
97	3356	wscript.exe
98	3976	wscript.exe
99	552	wscript.exe
117	3356	wscript.exe
127	3976	wscript.exe
129	552	wscript.exe
131	3356	wscript.exe
132	3976	wscript.exe
133	552	wscript.exe
134	3356	wscript.exe
135	3976	wscript.exe
136	552	wscript.exe
137	3356	wscript.exe
138	3356	wscript.exe
139	3976	wscript.exe
140	552	wscript.exe
141	3356	wscript.exe
142	3976	wscript.exe
143	552	wscript.exe
144	3356	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8aa5dd5a8392d399292fd831f9ebc486.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8aa5dd5a8392d399292fd831f9ebc486.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VwCyQuQTsw.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VwCyQuQTsw.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VwCyQuQTsw.js	wscript.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8aa5dd5a8392d399292fd831f9ebc486 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\8aa5dd5a8392d399292fd831f9ebc486.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8aa5dd5a8392d399292fd831f9ebc486 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\8aa5dd5a8392d399292fd831f9ebc486.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8aa5dd5a8392d399292fd831f9ebc486 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\8aa5dd5a8392d399292fd831f9ebc486.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8aa5dd5a8392d399292fd831f9ebc486 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\8aa5dd5a8392d399292fd831f9ebc486.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\software\microsoft\windows\currentversion\run	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3976	4520	wscript.exe	80
PID 4520 wrote to memory of 3976	4520	wscript.exe	80
PID 4520 wrote to memory of 3356	4520	wscript.exe	81
PID 4520 wrote to memory of 3356	4520	wscript.exe	81
PID 3356 wrote to memory of 552	3356	wscript.exe	82
PID 3356 wrote to memory of 552	3356	wscript.exe	82

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\8aa5dd5a8392d399292fd831f9ebc486.js
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\VwCyQuQTsw.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:3976
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\8aa5dd5a8392d399292fd831f9ebc486.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\VwCyQuQTsw.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\8aa5dd5a8392d399292fd831f9ebc486.js

Filesize
48KB

MD5
8aa5dd5a8392d399292fd831f9ebc486

SHA1
b7815f4df84394870dd7ca91c731fe606f726afd

SHA256
754416cc0f441aef7bacb842368fd06744048c4219943d5bd093e2a7e17f9267

SHA512
82b1f15b16f4f73947165084ecdcf9ef28ec02f29ceb86eb1ba831c9b2d561d72c311965532a363bd03cbcca0f8497acf8e9a3672c29a86cfe71ef1aa4e4e78a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8aa5dd5a8392d399292fd831f9ebc486.js

Filesize
48KB

MD5
8aa5dd5a8392d399292fd831f9ebc486

SHA1
b7815f4df84394870dd7ca91c731fe606f726afd

SHA256
754416cc0f441aef7bacb842368fd06744048c4219943d5bd093e2a7e17f9267

SHA512
82b1f15b16f4f73947165084ecdcf9ef28ec02f29ceb86eb1ba831c9b2d561d72c311965532a363bd03cbcca0f8497acf8e9a3672c29a86cfe71ef1aa4e4e78a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VwCyQuQTsw.js

Filesize
8KB

MD5
06c11af5dfc0cf6508e44b29ea394816

SHA1
4c9f9d9a109554d15c8ab2721cf3b2206fad0147

SHA256
b6d2658e1098c8a48ccbc9a8dd145d96d3933cac3903147d65b4d7da33376a6d

SHA512
a456948be194c8b7add9f037471430afe43391a4a1b7237b306ddce82357cdc549fdd8fd70481ecab3c6d89c16b9497c5cb4deec49423eb16ac8514c22580a48

Download Submit
C:\Users\Admin\AppData\Roaming\VwCyQuQTsw.js

Filesize
8KB

MD5
06c11af5dfc0cf6508e44b29ea394816

SHA1
4c9f9d9a109554d15c8ab2721cf3b2206fad0147

SHA256
b6d2658e1098c8a48ccbc9a8dd145d96d3933cac3903147d65b4d7da33376a6d

SHA512
a456948be194c8b7add9f037471430afe43391a4a1b7237b306ddce82357cdc549fdd8fd70481ecab3c6d89c16b9497c5cb4deec49423eb16ac8514c22580a48

Download Submit
C:\Users\Admin\AppData\Roaming\VwCyQuQTsw.js

Filesize
8KB

MD5
06c11af5dfc0cf6508e44b29ea394816

SHA1
4c9f9d9a109554d15c8ab2721cf3b2206fad0147

SHA256
b6d2658e1098c8a48ccbc9a8dd145d96d3933cac3903147d65b4d7da33376a6d

SHA512
a456948be194c8b7add9f037471430afe43391a4a1b7237b306ddce82357cdc549fdd8fd70481ecab3c6d89c16b9497c5cb4deec49423eb16ac8514c22580a48

Download Submit