vjw0rm | 6b2b1415c898b1c1770ba62a1ecfb870a626a47d3f72811f803c2ec651808b71

General

Target

Spécifications de la commande.js
Size

26KB
MD5

890730ddebf9affaebc94bd26ca5ba14
SHA1

184fd52a0525b68c964f2b1c68fc7ed0f93a41b2
SHA256

822b0e065dd9e5bb4441ab4e7641f73e34d240272b2c664141d07abdd0ed7f2d
SHA512

77220a8c9c38a2fd5bf31243e52ea9eb50429cd2554b7709d19beae64076208b10bdb9e4e76cee2a931a871a763a5a7a7b4adefb18c7eaeac7b38fc1e7c6476a
SSDEEP

768:LqWqIHKOv52EIhyW3ub2SlnnPYEJr8sv/hFXpMkdDkyO:LqWzHB5GhbuqSlnwj+JppMcIyO

Score

10^/10

vjw0rm discovery persistence trojan worm

Malware Config

Extracted

Family

vjw0rm

C2

http://severdops.ddns.net:5050

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
27	380	wscript.exe
74	380	wscript.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spécifications de la commande.js	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4112	9296npt.exe

Loads dropped DLL 1 IoCs

pid	Process
4112	9296npt.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1CYH0WDT4T = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spécifications de la commande.js\""	wscript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Funktionsanslagene102\champignongartneris.ini	9296npt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4060	schtasks.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 4060	380	wscript.exe	87
PID 380 wrote to memory of 4060	380	wscript.exe	87
PID 380 wrote to memory of 4112	380	wscript.exe	110
PID 380 wrote to memory of 4112	380	wscript.exe	110
PID 380 wrote to memory of 4112	380	wscript.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Spécifications de la commande.js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Spécifications de la commande.js
  2⤵
  - Creates scheduled task(s)
  PID:4060
- C:\Users\Admin\AppData\Local\Temp\9296npt.exe
  "C:\Users\Admin\AppData\Local\Temp\9296npt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9296npt.exe

Filesize
274KB

MD5
b1affb57489ac0718bfdb5ad86127f91

SHA1
5f28f824aab6d4132f5ecd4829cdff79e4e550ec

SHA256
347d8a0ebcc67f3321145f4a676cf54d7f9a15b57a102a2b5b1c78c2869226c4

SHA512
6119180703e4c1062bcace0de111f7f126bc5aab28f839f52c4cae65f6afdc538bf7d1287b1dddd3290f56c769ee07274b37cefe1f90135ac34e2ea23c57be0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\9296npt.exe

Filesize
274KB

MD5
b1affb57489ac0718bfdb5ad86127f91

SHA1
5f28f824aab6d4132f5ecd4829cdff79e4e550ec

SHA256
347d8a0ebcc67f3321145f4a676cf54d7f9a15b57a102a2b5b1c78c2869226c4

SHA512
6119180703e4c1062bcace0de111f7f126bc5aab28f839f52c4cae65f6afdc538bf7d1287b1dddd3290f56c769ee07274b37cefe1f90135ac34e2ea23c57be0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\9296npt.exe

Filesize
274KB

MD5
b1affb57489ac0718bfdb5ad86127f91

SHA1
5f28f824aab6d4132f5ecd4829cdff79e4e550ec

SHA256
347d8a0ebcc67f3321145f4a676cf54d7f9a15b57a102a2b5b1c78c2869226c4

SHA512
6119180703e4c1062bcace0de111f7f126bc5aab28f839f52c4cae65f6afdc538bf7d1287b1dddd3290f56c769ee07274b37cefe1f90135ac34e2ea23c57be0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd86A2.tmp\System.dll

Filesize
12KB

MD5
8cf2ac271d7679b1d68eefc1ae0c5618

SHA1
7cc1caaa747ee16dc894a600a4256f64fa65a9b8

SHA256
6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

SHA512
ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads