vjw0rm | 5154aae086fff67c92e4b336f788572a138bc255741b9aa9083442b750350cce

Analysis

max time kernel
595s
max time network
601s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17/01/2023, 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PAYMENT FOR INVOICES.js
Size

1.4MB
MD5

d417724d472894254a6c037c5570c843
SHA1

6d4b62ebebcd98d4af03dc5967069a90404a8da7
SHA256

d77b1847964ea75c7a8f478e30b74a1877fcad2140258d5fa217da72559152f4
SHA512

694e1638d1d2cd648ef04cc54d3351f538e360ee46537c822ab24b5eb7c40b82b61c2e98a3e78590710153a8ceb6be416d7a4b496d5ca9c14a63d4b87c88c0c1
SSDEEP

24576:VnlZziDqBFYTdbrvawzgkiHv47+aH76s+mhucjzZB:lLi+iff4Hw7dOPcf

Score

10^/10

vjw0rm collection spyware stealer trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 42 IoCs

flow	pid	Process
14	4548	wscript.exe
19	4548	wscript.exe
34	4548	wscript.exe
37	4548	wscript.exe
41	4548	wscript.exe
55	4548	wscript.exe
56	4548	wscript.exe
57	4548	wscript.exe
58	4548	wscript.exe
59	4548	wscript.exe
60	4548	wscript.exe
61	4548	wscript.exe
62	4548	wscript.exe
63	4548	wscript.exe
64	4548	wscript.exe
65	4548	wscript.exe
66	4548	wscript.exe
69	4548	wscript.exe
72	4548	wscript.exe
73	4548	wscript.exe
77	4548	wscript.exe
78	4548	wscript.exe
79	4548	wscript.exe
80	4548	wscript.exe
81	4548	wscript.exe
82	4548	wscript.exe
83	4548	wscript.exe
84	4548	wscript.exe
85	4548	wscript.exe
86	4548	wscript.exe
87	4548	wscript.exe
88	4548	wscript.exe
89	4548	wscript.exe
90	4548	wscript.exe
91	4548	wscript.exe
92	4548	wscript.exe
93	4548	wscript.exe
94	4548	wscript.exe
95	4548	wscript.exe
96	4548	wscript.exe
97	4548	wscript.exe
98	4548	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
2344	OZ.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jFzOsLlNJD.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jFzOsLlNJD.js	wscript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OZ.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OZ.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OZ.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3000	2344	WerFault.exe	84

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	OZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	OZ.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2344	OZ.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4548	4352	wscript.exe	83
PID 4352 wrote to memory of 4548	4352	wscript.exe	83
PID 4352 wrote to memory of 2344	4352	wscript.exe	84
PID 4352 wrote to memory of 2344	4352	wscript.exe	84
PID 4352 wrote to memory of 2344	4352	wscript.exe	84

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OZ.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OZ.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PAYMENT FOR INVOICES.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\jFzOsLlNJD.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:4548
- C:\Users\Admin\AppData\Local\Temp\OZ.exe
  "C:\Users\Admin\AppData\Local\Temp\OZ.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 2164
    3⤵
    - Program crash
    PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2344 -ip 2344
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OZ.exe

Filesize
756KB

MD5
77bc4d2c99082b7398c25ce09291b03e

SHA1
e9c2882cc3c1b58855428d513331b4be64b3ae7c

SHA256
a6e8cfe4af4de47ac8158b8adbc25a65f37de05946c5ff363179b4b556f5d169

SHA512
0d901deb1af1a0624b466acb765697ce16e214a5b8311444f75c8b3b68c1c5dc849a140999274cf30a8c9fc0b8b0bb24aeff49dd944bcd7c019593f6a8ce6ee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\OZ.exe

Filesize
756KB

MD5
77bc4d2c99082b7398c25ce09291b03e

SHA1
e9c2882cc3c1b58855428d513331b4be64b3ae7c

SHA256
a6e8cfe4af4de47ac8158b8adbc25a65f37de05946c5ff363179b4b556f5d169

SHA512
0d901deb1af1a0624b466acb765697ce16e214a5b8311444f75c8b3b68c1c5dc849a140999274cf30a8c9fc0b8b0bb24aeff49dd944bcd7c019593f6a8ce6ee2

Download Submit
C:\Users\Admin\AppData\Roaming\jFzOsLlNJD.js

Filesize
18KB

MD5
2ae3f4bf78428996391b735422d69932

SHA1
c7cabe2cb2488d4dec8c31ec5d3694244f559149

SHA256
c2f18d683b7e47c1758130920b336bdd440c3e879a2175b241b4b5d58e79604d

SHA512
9f95c35cca567fb73fe4164402e5662fbe8839934491cc7e447338235ee4584f0c94ecb4dd1477cf2fe9f931b1a6ce0223f610cae54aab0d3aa789674bb880d8

Download Submit
memory/2344-137-0x00000000009B0000-0x0000000000A74000-memory.dmp

Filesize
784KB

Download
memory/2344-138-0x0000000007950000-0x00000000079B6000-memory.dmp

Filesize
408KB

Download
memory/2344-139-0x0000000008660000-0x0000000008682000-memory.dmp

Filesize
136KB

Download
memory/2344-140-0x0000000008B00000-0x0000000008B0A000-memory.dmp

Filesize
40KB

Download
memory/2344-141-0x0000000008B30000-0x0000000008B42000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads