vjw0rm | e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04/08/2023, 21:27

Target
Scanned.js
Size 3KB
Sample230804-1arsfaee26
SHA256 e99599c5b1407b96f88bfcca51264c13d7ff5e7d00c2c3868636b575bb06fcae
MD5 d65a553af676282e15cb3ab7cf998998
SHA1 dd76b76df265973b7aea2f3ffaba45123024f05c
SHA512 d7ca6988dfda70a9e390ebe2a65c2a01bd0fe2407df8be83276a1f31781b1bc143daad40ff90310d0fe78c3beffc3b817b8c32637de732c049689d12b62ab4a7
MD5 SHA1 SHA512

Score

10^/10

Family

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	1576	wscript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scanned.js	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\5RQEBVICNC = "\"C:\\Users\\Admin\\AppData\\Roaming\\Scanned.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
1212	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1212	1576	wscript.exe	29
PID 1576 wrote to memory of 1212	1576	wscript.exe	29
PID 1576 wrote to memory of 1212	1576	wscript.exe	29

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Scanned.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Scanned.js
  2⤵
  - Creates scheduled task(s)
  PID:1212