vjw0rm | d72e9e277f3eadd7b9097a7f8d1d00f905d97df92bbf66982e51899a9d6eec60

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-04-2023 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AWB#476587652.PDF.js
Size

3.3MB
MD5

0d0b1fc606201ddbf74b4833e08994b3
SHA1

177895061db3b2264b72bd57b96e707e7a3e50b8
SHA256

d72e9e277f3eadd7b9097a7f8d1d00f905d97df92bbf66982e51899a9d6eec60
SHA512

45fef7799272fc8606a50c7f75c280a121beb92119f11c00db6155c8b084ae69635c0201fdd96fa0398e33b43f30333767940a75bd5fb88908fb4050160f37b6
SSDEEP

24576:pJSd1V8/DH6mBy0ayVbGw9GZ0dKEMRs1Ayq+cISRxQCNj+4AX:ntbNX

Score

10^/10

vjw0rm trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 9 IoCs

flow	pid	Process
4	1680	WScript.exe
6	1680	WScript.exe
7	1680	WScript.exe
15	1680	WScript.exe
16	1680	WScript.exe
17	1680	WScript.exe
19	1680	WScript.exe
20	1680	WScript.exe
23	1680	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FAklApsLii.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FAklApsLii.js	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1680	1352	wscript.exe	28
PID 1352 wrote to memory of 1680	1352	wscript.exe	28
PID 1352 wrote to memory of 1680	1352	wscript.exe	28
PID 1352 wrote to memory of 1744	1352	wscript.exe	29
PID 1352 wrote to memory of 1744	1352	wscript.exe	29
PID 1352 wrote to memory of 1744	1352	wscript.exe	29

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\AWB#476587652.PDF.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\FAklApsLii.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:1680
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\pumtjblptz.txt"
  2⤵
  PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\FAklApsLii.js

Filesize
346KB

MD5
504251620320ddd73e04fd077598f06b

SHA1
ed16dd17a1b3fd621083999e1697ac8d7d4e196a

SHA256
5fc4c580b97320b95dae37a9ee422735eb39b660a890d41f1631369f3f477f23

SHA512
69f290c8af09736666189ba80a4147dcaf9da793ece50a9a7523e9a27c011f8773971e2687cddc6c04b8d54a15fabdca80d9de63e62a00a4a4de26b9d2ca1157

Download Submit
C:\Users\Admin\AppData\Roaming\pumtjblptz.txt

Filesize
209KB

MD5
5908fc19ceb339ac7559095bc462e625

SHA1
c7d780b9524c732e26112d81a067a8fa664e805c

SHA256
255f2eeceeca9b1f4075e8a90a6f2ee46032ce60947b6ab612eaf347d5ae987e

SHA512
f3710dc3a78f6af0f59f78aa20f681816a50e2f7a5ccf7783e62c232476e7afe7cedffceb58df6e19a32f1282c79251fa54cadbf9a45509ec90e0cabf490ad82

Download Submit
memory/1744-70-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1744-71-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1744-72-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1744-98-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1744-115-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1744-119-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1744-129-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download