vjw0rm | 02cc696570db415f09b6cd2e8d05aa463e03cf0d3b4a6bc92ee367d6c357f522

Analysis

max time kernel
142s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 01:00

Target

02cc696570db415f09b6cd2e8d05aa463e03cf0d3b4a6bc92ee367d6c357f522.js
Size

25KB
MD5

fb095067b1cea82381df42c7fd97a5c3
SHA1

98e7f6d6473be733886f2090efe3999935803a78
SHA256

02cc696570db415f09b6cd2e8d05aa463e03cf0d3b4a6bc92ee367d6c357f522
SHA512

d6c7c6651b97b29243843db189d05bd67acdff097282b07ae43d8021f78887eec2feb8074ee68817baa428d35a1588ae620d811c1f7cda04b39c8b325d388072
SSDEEP

384:vXot+AkpABR0CyZChNi1OtDt+QWtla7qxsbUEa9YdyG+BKMHXWUGqOQPmKE2M7La:9zgR0k414Yba7qxOUEa6yAMmMdAa

Score

10^/10

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 16 IoCs

Processes:

wscript.exe

Drops startup file 1 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\02cc696570db415f09b6cd2e8d05aa463e03cf0d3b4a6bc92ee367d6c357f522.js	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\UQHC8JRDD3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\02cc696570db415f09b6cd2e8d05aa463e03cf0d3b4a6bc92ee367d6c357f522.js\""	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2560 schtasks.exe

pid	process
2560	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 2548 wrote to memory of 2560	2548	wscript.exe	schtasks.exe
PID 2548 wrote to memory of 2560	2548	wscript.exe	schtasks.exe
PID 2548 wrote to memory of 2560	2548	wscript.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\02cc696570db415f09b6cd2e8d05aa463e03cf0d3b4a6bc92ee367d6c357f522.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\02cc696570db415f09b6cd2e8d05aa463e03cf0d3b4a6bc92ee367d6c357f522.js
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2560