vjw0rm | ce199d986d0d04279edd245f3a0fe115c7c680a214d73feed8a8451b7b7feb94

General

Target

f8f5bed73850632ff591989c5b88f9ee_JaffaCakes118.js
Size

200KB
MD5

f8f5bed73850632ff591989c5b88f9ee
SHA1

ce9066586bf44f0e77243ebdd6d2ce109cf7bd7a
SHA256

ce199d986d0d04279edd245f3a0fe115c7c680a214d73feed8a8451b7b7feb94
SHA512

72be43f9ce219a02fc9ee7395867e91f9b175fffa3cf6c69800d5a8ab3e7617bf22e56fa5d1506bfc5b81d303f86c4be278debaad472e7a7bd41e10a0b31a9a9
SSDEEP

3072:Udaf0RYaop8OBm/wUvHd9ucLxPfhpDO2r63V1r7Dfi8oUuEF8nc:DKotBkzCc9nLA3V1HTBuEYc

Score

10^/10

vjw0rm persistence trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\paCczCKasj.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\paCczCKasj.js	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\paCczCKasj.js\""	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 2240 wrote to memory of 2992	2240	wscript.exe	WScript.exe
PID 2240 wrote to memory of 2992	2240	wscript.exe	WScript.exe
PID 2240 wrote to memory of 2992	2240	wscript.exe	WScript.exe
PID 2240 wrote to memory of 2988	2240	wscript.exe	javaw.exe
PID 2240 wrote to memory of 2988	2240	wscript.exe	javaw.exe
PID 2240 wrote to memory of 2988	2240	wscript.exe	javaw.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\f8f5bed73850632ff591989c5b88f9ee_JaffaCakes118.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\paCczCKasj.js"
2⤵
- Drops startup file
- Adds Run key to start application
PID:2992

C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ypslmugh.txt"
2⤵
PID:2988

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\paCczCKasj.js
Filesize
9KB

MD5
73cccf2fad42bfd86b4a218c256e3fd7

SHA1
f3ff6f9f588f7f8a725e258e984e128f580f28ea

SHA256
495768f61cf6a338ca8e50e5f453a4ce6af19fd5881b3e848cb7741564c8ca57

SHA512
9b86af50aeb1ede45103318d51e55c97c90b4a9aec33e916824c910965f2abb777f8a4d805ad44e4bd4ff92503b7c2f054b7c3b368e26af901a10c48160d9cc5

Download Submit
C:\Users\Admin\AppData\Roaming\ypslmugh.txt
Filesize
92KB

MD5
d586663f3ff01f6ccddc890a9013aad6

SHA1
4ed9f24d7eeda73c96fef0128d991cfab005e0f8

SHA256
a32832b7da66a6c36a28bc5f2d49b70a555980032d4d0f823cf514089e226b59

SHA512
a1b8c0336ee6c8323329ba1c4a892943e238c1dbad15d78bdf5ae4fc089b397c4dce4770dfe03752cddf52819b62106cbb1a960ebaa0c4125df01a42846ebb98

Download Submit
memory/2988-14-0x0000000002790000-0x0000000005790000-memory.dmp

Filesize
48.0MB

Download
memory/2988-17-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-24-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-28-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-33-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-37-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-45-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-46-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-49-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-50-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-51-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-53-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-56-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-57-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-58-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-62-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-65-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-78-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-81-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-83-0x0000000002790000-0x0000000005790000-memory.dmp

Filesize
48.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads