vjw0rm | 2de716414a5246e7d4f1d9679a9c5fdefd194c30807331d05798253ebceb87a2

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 12:36

Target

#CHOO1.js
Size

17KB
MD5

fac61c5e8f3026c1a1b63c21423a2701
SHA1

c14c72c7e99a1b8166d009a89c8f6b1111a8da2a
SHA256

77307f92ac36d5dce119e092099842fedd2f37432b578914af22b7ad7c1ccf94
SHA512

19f7420a6cf00f25c75dd3205823645b2f3e0f77d8b817c9c1e22a9c36799e2efb880d26e886bbf9c7d6de413f8c5fe2ad3a88a6eb9b2761fde00506bd14a711
SSDEEP

384:bv4FxNXwil3u4W430GvACEOyMU+qxl249TmO0XNWj7WKSKmFlKl:L4F/l3Q2ZEOG+hKTmOrfWlKl

Score

10^/10

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Vjw0rm family
vjw0rm

Blocklisted process makes network request 6 IoCs

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\#CHOO1.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\#CHOO1.js	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\PU6BS6WNLD = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\#CHOO1.js\""	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2408	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2408	1968	wscript.exe	31
PID 1968 wrote to memory of 2408	1968	wscript.exe	31
PID 1968 wrote to memory of 2408	1968	wscript.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\#CHOO1.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\#CHOO1.js
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2408