vjw0rm | 5bb9ac9554d7d5b6dc6267071c9e8861f7c4e3b6699fa813adcfd8e68d931ca3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6a0c90577be13a03ce39b87a5a8435f.js
Size

116KB
MD5

f6a0c90577be13a03ce39b87a5a8435f
SHA1

51326015ee690361761a076fd1edf845c94b8c42
SHA256

5bb9ac9554d7d5b6dc6267071c9e8861f7c4e3b6699fa813adcfd8e68d931ca3
SHA512

6d101f510fdb20e6bb121221195c2881e0725f860c5cb7951d12dca12148487bc1694cc08d646d6aa47378bde2a3e6b53102d343d9925dc0b4722c6369725ae5
SSDEEP

192:n0u40xWWHrW9WHxq0i1dhwhw9AFX9xFMM9cfR8BCO92spMU5f4sv1Ml8zDktfME8:t9WWHFTLL2RyCDlGTWW5qKLaMiOfF

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 12 IoCs

flow	pid	Process
4	1064	wscript.exe
6	1064	wscript.exe
7	1064	wscript.exe
9	1064	wscript.exe
10	1064	wscript.exe
11	1064	wscript.exe
13	1064	wscript.exe
14	1064	wscript.exe
15	1064	wscript.exe
17	1064	wscript.exe
18	1064	wscript.exe
19	1064	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f6a0c90577be13a03ce39b87a5a8435f.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f6a0c90577be13a03ce39b87a5a8435f.js	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCT0DVSIH6 = "'C:\\Users\\Admin\\AppData\\Local\\Temp\\f6a0c90577be13a03ce39b87a5a8435f.js'"	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\f6a0c90577be13a03ce39b87a5a8435f.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads