vjw0rm | 60082075efca8009713f4a5e098287a01e72844080d1ce2fcdd7bf6a89a538c2

General

Target

ORDER.js
Size

1.3MB
MD5

7714dea12b46a3c51e554e277bf4292e
SHA1

30570d67c31f0ddcd42572f5110a8b1e25fb80e1
SHA256

f7d5219e1f60e9cbd4e8ac2dbd7fe8dd3238413cc4fe042c33c65b5ea310420a
SHA512

1743771beb4d602edc25d99b0f02c31fc7090832b8ba87541f1225ff95457873301ab63b50ea1a9337cad1cbba04f9d011214f3f62e301d94f178aa88945738a
SSDEEP

24576:xNRtLzvddO057nsmwXSVYd/AQOoidE1uU4SXi:xzt9dLuXfRi

Score

10^/10

vjw0rm collection spyware stealer trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 15 IoCs

Processes:

wscript.exe

flow	pid	process
10	1004	wscript.exe
25	1004	wscript.exe
32	1004	wscript.exe
42	1004	wscript.exe
46	1004	wscript.exe
49	1004	wscript.exe
52	1004	wscript.exe
53	1004	wscript.exe
54	1004	wscript.exe
57	1004	wscript.exe
58	1004	wscript.exe
59	1004	wscript.exe
60	1004	wscript.exe
61	1004	wscript.exe
62	1004	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

Payload (5).exe

pid process

4204 Payload (5).exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe

pid	process
4204	Payload (5).exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YIzwDNqxHb.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YIzwDNqxHb.js	wscript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Payload (5).exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payload (5).exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payload (5).exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payload (5).exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ipinfo.io
15 ipinfo.io
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3588 4204 WerFault.exe Payload (5).exe

flow	ioc
14	ipinfo.io
15	ipinfo.io

pid	pid_target	process	target process
3588	4204	WerFault.exe	Payload (5).exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Payload (5).exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Payload (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Payload (5).exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Payload (5).exe

description pid process

Token: SeDebugPrivilege 4204 Payload (5).exe

description	pid	process
Token: SeDebugPrivilege	4204	Payload (5).exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 4932 wrote to memory of 1004	4932	wscript.exe	wscript.exe
PID 4932 wrote to memory of 1004	4932	wscript.exe	wscript.exe
PID 4932 wrote to memory of 4204	4932	wscript.exe	Payload (5).exe
PID 4932 wrote to memory of 4204	4932	wscript.exe	Payload (5).exe
PID 4932 wrote to memory of 4204	4932	wscript.exe	Payload (5).exe

outlook_office_path 1 IoCs

Processes:

Payload (5).exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payload (5).exe

outlook_win_path 1 IoCs

Processes:

Payload (5).exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Payload (5).exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ORDER.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4932

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\YIzwDNqxHb.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
PID:1004

C:\Users\Admin\AppData\Local\Temp\Payload (5).exe
"C:\Users\Admin\AppData\Local\Temp\Payload (5).exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1596
3⤵
- Program crash
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4204 -ip 4204
1⤵
PID:2780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Payload (5).exe
Filesize
744KB

MD5
96b766fa1ddaae53c33517fd93e2b04a

SHA1
71b7c8302c334dd2843b573d6183dc5ca6444752

SHA256
ac217cff0743fcaaec414f9b988b5ce138f530b5b7dbe4f03021842670d74ca3

SHA512
a3ac31939500de33539b397d4696d10d0b6e4e6d3d338bae68281f0464c28180072ab23bdcc85d19e119f9bbe66aa09f8da03fd653efddf72d1820d19aa0e15e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Payload (5).exe
Filesize
744KB

MD5
96b766fa1ddaae53c33517fd93e2b04a

SHA1
71b7c8302c334dd2843b573d6183dc5ca6444752

SHA256
ac217cff0743fcaaec414f9b988b5ce138f530b5b7dbe4f03021842670d74ca3

SHA512
a3ac31939500de33539b397d4696d10d0b6e4e6d3d338bae68281f0464c28180072ab23bdcc85d19e119f9bbe66aa09f8da03fd653efddf72d1820d19aa0e15e

Download Submit
C:\Users\Admin\AppData\Roaming\YIzwDNqxHb.js
Filesize
6KB

MD5
f5900623d262e28b5b5169d4307406df

SHA1
1eba3a193e440e9373133f69cff2f9cff6373189

SHA256
9530c305096a7bc5443c50079a77e7aee12d6dea1770f279ccf8f6e5f149f334

SHA512
d0ed8912d5ff927bfa0f05616f4712dbf6a60349839d4722691c02eb7cb0ebf2d1f1cbbe8becd1a77b5c71821b623323811d9255d1f8b9060cb928f31a996f97

Download Submit
memory/1004-133-0x0000000000000000-mapping.dmp

Download
memory/4204-135-0x0000000000000000-mapping.dmp

Download
memory/4204-138-0x0000000000820000-0x00000000008E0000-memory.dmp

Filesize
768KB

Download
memory/4204-139-0x00000000077A0000-0x0000000007806000-memory.dmp

Filesize
408KB

Download
memory/4204-140-0x0000000008B20000-0x0000000008B42000-memory.dmp

Filesize
136KB

Download
memory/4204-141-0x0000000008FD0000-0x0000000008FDA000-memory.dmp

Filesize
40KB

Download
memory/4204-142-0x0000000009000000-0x0000000009012000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads