vjw0rm | 12f923139b9a61319015b4250cc63939a2fab06a6db05560df66837bf2098e53

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 23:46

Target

Invoice #3381.js
Size

3KB
MD5

abb769d734f8212d96ea432da12cbc15
SHA1

186d2abc93687bfa9036319641b7fa6f3245b798
SHA256

0b471b1080ff4600483e4459e88aae2bb54f4ba84416b614d58f72bfa24b35a9
SHA512

308e2ecadeeea21e46fa2eacfa71dd46323bcd00391d4d92030ae9775d0c8497098bfd14423d0c2e53b85f3420da5f5a069c79dbf23e103f45441bea236f37ff

Score

10^/10

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 7 IoCs

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Invoice #3381.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Invoice #3381.js	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\EX2WNAPNLF = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Invoice #3381.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
2912	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2912	3068	wscript.exe	29
PID 3068 wrote to memory of 2912	3068	wscript.exe	29
PID 3068 wrote to memory of 2912	3068	wscript.exe	29

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Invoice #3381.js"
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\Invoice #3381.js
  2⤵
  - Creates scheduled task(s)
  PID:2912