vjw0rm | 6faec8bf17abcfc03ce14e3b125d545f2f5d72548a59e814d7e279281210e770

Analysis

max time kernel
128s
max time network
138s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 07:48

Target

NEAS.cb9180e29f04c5cb798032bfc44d4810.js
Size

236KB
MD5

cb9180e29f04c5cb798032bfc44d4810
SHA1

694bf337ac85528ca316d6becee3144e68df2aa3
SHA256

6faec8bf17abcfc03ce14e3b125d545f2f5d72548a59e814d7e279281210e770
SHA512

59b7f3363bc32df6e1283c3022897f439d4972baf5ba63027a17f981609d34743a6e26a2e0753900f1f79e9a1215e9b95c79660748bb14949aef955821631141
SSDEEP

3072:7Wu1AT2XJAvZBEkHiMg3mMlbYH+2JDLCGPERQ3:7Wu1AT2XJAvZB3HxpMlbYH+sLCGPqQ3

Score

10^/10

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 10 IoCs

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEAS.cb9180e29f04c5cb798032bfc44d4810.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NEAS.cb9180e29f04c5cb798032bfc44d4810.js	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZ3A7IG0VR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.cb9180e29f04c5cb798032bfc44d4810.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
2756	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2756	2876	wscript.exe	29
PID 2876 wrote to memory of 2756	2876	wscript.exe	29
PID 2876 wrote to memory of 2756	2876	wscript.exe	29

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cb9180e29f04c5cb798032bfc44d4810.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\NEAS.cb9180e29f04c5cb798032bfc44d4810.js
  2⤵
  - Creates scheduled task(s)
  PID:2756