vjw0rm | 50181ff5992fb7bad3d58e6c9950b906fde97815ccd6c75b5757bd22a610cbe8

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2023, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11d1fdfa525496269b77a3d517fc686facbdfa57c4b4a5869b69df96f49172f5.js
Size 37KB
Sample230126-3c6eqafg67
SHA256 11d1fdfa525496269b77a3d517fc686facbdfa57c4b4a5869b69df96f49172f5
MD5 2f7ac963b84154b7323b89574ad57985
SHA1 c67ddbeb7ea011d03d5c435c45fbed182c6eb017
SHA512 0fb2b2e78992af19c06a3da1853356af24f032774f13d519314336846d5e356b76b5966686d270d096c756e2444e62acef5d9dfb645da7cccd84355548285786
SSDEEP 768:YgNUdDwV0GXFwG2dEtUnv621yNs+2w9nrLRtf2Yr:Yg6+0G1wGOEtAv621X+2w9nX/f2Yr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 21 IoCs

flow	pid	Process
6	2276	wscript.exe
7	2116	wscript.exe
14	2116	wscript.exe
20	2116	wscript.exe
21	2276	wscript.exe
30	2116	wscript.exe
37	2116	wscript.exe
42	2116	wscript.exe
45	2276	wscript.exe
48	2116	wscript.exe
49	2116	wscript.exe
50	2276	wscript.exe
51	2116	wscript.exe
54	2116	wscript.exe
55	2116	wscript.exe
56	2276	wscript.exe
57	2116	wscript.exe
58	2116	wscript.exe
59	2276	wscript.exe
60	2116	wscript.exe
61	2116	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11d1fdfa525496269b77a3d517fc686facbdfa57c4b4a5869b69df96f49172f5.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11d1fdfa525496269b77a3d517fc686facbdfa57c4b4a5869b69df96f49172f5.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KayIONGmjY.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KayIONGmjY.js	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11d1fdfa525496269b77a3d517fc686facbdfa57c4b4a5869b69df96f49172f5 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\11d1fdfa525496269b77a3d517fc686facbdfa57c4b4a5869b69df96f49172f5.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11d1fdfa525496269b77a3d517fc686facbdfa57c4b4a5869b69df96f49172f5 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\11d1fdfa525496269b77a3d517fc686facbdfa57c4b4a5869b69df96f49172f5.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2116	2276	wscript.exe	79
PID 2276 wrote to memory of 2116	2276	wscript.exe	79

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\11d1fdfa525496269b77a3d517fc686facbdfa57c4b4a5869b69df96f49172f5.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\KayIONGmjY.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:2116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KayIONGmjY.js

Path C:\Users\Admin\AppData\Roaming\KayIONGmjY.js
Size 5KB
SHA256 e4e2543028c0169adfec99b0ad75b40a0b8ecb5caa813861dc235a81d71d5c2e
MD5 c316a0162333eed25de3db93729b6dbf
SHA1 588aad9c42ceb0af456f87d24f58be9941f685c8
SHA512 ba962708a429ca09249d1cbeb7a49869efa8fa0085dd7a2bd7790daeb2fe71fc30d447d4789f6c4cf06dc1fc7c35c6b83f00f03d738356612997a962758ad82e
SSDEEP 96:nFs5Uwd1HaFpBW1jHqnJ4R2LPE+/1R2CLrO9Ce7F6nHSsYjlYa5:nFsVL6cUJvo+lOR6nHSsG
MD5 SHA1 SHA512 SSDEEP

Submit Download