vjw0rm | 524c411868be9769efa1197add86395053157040e26310efa2648c4b0f8bc50d

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2023 14:45

Target

1ZWAJSAR001.js
Size

300.0MB
MD5

16f64a9f1e8298c60d410e649d4f9af6
SHA1

4ecbd826dd26c8cb1c83e90b260fabc01fb292b3
SHA256

07832ced9085948c808f5d084569f19e7ac6d7ac033d9fe307557b2d62276c43
SHA512

99bf973c22c46827ab153f13365cdffeb47a15f300693f5cbf3faaff71a7043e5a7a1c083c2ce2b02cfb085ba3bd77c8c43f6d0fbbfb9cab74e990318f8cde2b
SSDEEP

192:KERPOQ5/EwSCSgCoR57ATri9xKrw/SDLaMTiye22k8T4Z1FOJ0ow4:KsOA/EwO4lT9xKrw6DLaM5iTTXaE

Score

10^/10

Family

vjw0rm

http://sgdghhdh62.duckdns.org:8050

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow pid process

7 1264 wscript.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation wscript.exe

flow	pid	process
7	1264	wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ZWAJSAR001.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ZWAJSAR001.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TLMDOPHRA6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1ZWAJSAR001.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1196 schtasks.exe

pid	process
1196	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1264 wrote to memory of 1196	1264	wscript.exe	schtasks.exe
PID 1264 wrote to memory of 1196	1264	wscript.exe	schtasks.exe

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\1ZWAJSAR001.js
2⤵
- Creates scheduled task(s)
PID:1196