vjw0rm | 8f5a6d4e7058dde1ab46efd1497b6d49e702d2d627a5cdef9a71a0e7ff40dcb8

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2023 19:23

Target

Invoice0214223.js
Size

3KB
MD5

f9adb1451b03a65ea245677dd394fc0a
SHA1

ecd4244677b57f8e154eb1ee62067c46d0fab3b3
SHA256

8f5a6d4e7058dde1ab46efd1497b6d49e702d2d627a5cdef9a71a0e7ff40dcb8
SHA512

a1037f469b2391509d85a18c1ea44f1729f06acd209cff3c7af31360764a0f4104875c682d62bba32e8a3581c141975862c5248b059d897156b872fff986a539

Score

10^/10

Family

vjw0rm

http://198.12.123.17:9406

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow pid process

4 3172 wscript.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wscript.exe

flow	pid	process
4	3172	wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Invoice0214223.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Invoice0214223.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\O08Q47NAMU = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Invoice0214223.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2124 schtasks.exe

pid	process
2124	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 3172 wrote to memory of 2124	3172	wscript.exe	schtasks.exe
PID 3172 wrote to memory of 2124	3172	wscript.exe	schtasks.exe

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\Invoice0214223.js
2⤵
- Creates scheduled task(s)
PID:2124